The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing local attackers to bypass Android's permission sandbox and gain full root access.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Zte |
|
No data.
No data.
References
History
Wed, 05 Aug 2026 10:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Zte
Zte nx799j (red Magic 11 Air) |
|
| Vendors & Products |
Zte
Zte nx799j (red Magic 11 Air) |
Wed, 05 Aug 2026 07:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV4_0
|
cvssV3_1
|
Wed, 05 Aug 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing local attackers to bypass Android's permission sandbox and gain full root access. | |
| Title | PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product | |
| Weaknesses | CWE-89 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: zte
Published: 2026-08-05T06:19:01.733Z
Updated: 2026-08-05T06:22:33.916Z
Reserved: 2026-05-27T01:01:53.326Z
Link: CVE-2026-49004
Vulnrichment
No data.
NVD
No data.
Redhat
No data.