CVE-2026-40002CWE-269

ZTE Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations.

Medium · published April 17, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
3.5
In the wild
Unconfirmed
What it is

Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations. The vulnerability stems from the lack of validation for applications accessing the service interface. Exploiting this vulnerability, an attacker can write files to specific partitions and set writable system properties.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00146 · 3.5th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-04-17T07:40Z
EPSS history
Timeline
  • 17 APR 07:40Z
    ZTE Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations.
    cvelistv5