Privilege escalation in Zte Nubia-In Nx809j
CVE-2026-40002
Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations. The vulnerability stems from the lack of validation for applications accessing the service interface. Exploiting this vulnerability, an attacker can write files to specific partitions and set writable system properties.
Vulnerability class: Privilege Escalation
EPSS: 0.001 (2.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L.
Affected products
- Zte Nubia-in_nx809j
- Zte Nubia-in_nx809j_firmware
- Zte Red Magic 11 Pro (Nx809j) — versions GEN_NEEA_NX809J V1.0.0B14MR1
Weakness classification (CWE)
References
- psirt@zte.com.cn (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-40002?
- CVE-2026-40002 is a medium-severity vulnerability in Zte Nubia-In Nx809j, classified under Improper Privilege Management. CVSS score: 5.0/10. Published 2026-04-17.
- How severe is CVE-2026-40002?
- Medium severity. CVSS v3 base score is 5.0 out of 10.