CVE-2026-49004

Name of the Vulnerable Software and Affected Versions ZTE NX799J (Red Magic 11 Air) (affected versions not specified)

Description The built-in PostgreSQL service contains misconfiguration flaws and command injection issues. The service operates with root privileges, listens on a specific port, and uses weak credentials. It supports the COPY FROM PROGRAM syntax, which enables local attackers to bypass the Android permission sandbox and obtain full root access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.