CVE-2026-49004— PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product
Quick assessment
Affected
ZTE NX799J (Red Magic 11 Air)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ZTE NX799J是中国ZTE公司的一款终端设备。 ZTE NX799J GEN_CN_NX799JV1.0.0B15版本存在SQL注入漏洞，该漏洞源于内置PostgreSQL服务配置不当和命令注入问题。该服务在特定端口上以root权限运行且受弱凭据保护，数据库支持COPY FROM PROGRAM语法，可能导致本地攻击者绕过Android权限沙箱并获得完全root访问权限。
Possible ATT&CK Techniques 3 AI
T1078 · Valid Accounts T1059.004 · Unix Shell T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| ZTE | NX799J (Red Magic 11 Air) | GEN_CN_NX799JV1.0.0B15 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-49004
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product
Source: CVE Program / CVE List V5
Vulnerability Description
The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing local attackers to bypass Android's permission sandbox and gain full root access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
ZTE NX799J SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ZTE NX799J是中国ZTE公司的一款终端设备。 ZTE NX799J GEN_CN_NX799JV1.0.0B15版本存在SQL注入漏洞，该漏洞源于内置PostgreSQL服务配置不当和命令注入问题。该服务在特定端口上以root权限运行且受弱凭据保护，数据库支持COPY FROM PROGRAM语法，可能导致本地攻击者绕过Android权限沙箱并获得完全root访问权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ZTE | NX799J (Red Magic 11 Air) | GEN_CN_NX799JV1.0.0B15 | - |
|
II. Public POCs for CVE-2026-49004
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49004
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-49004 (1)
IV. Related Vulnerabilities
Same vendor: ZTE
-
CVE-2026-108504
Unauthorized information retrieval vulnerability in ZTE Z80 -
CVE-2026-108503
Unauthorized information acquisition vulnerability in ZTE Z8 -
CVE-2026-108502
Information disclosure vulnerability in ZTE Z80 Ultra produc -
CVE-2026-108501
Unauthorized access vulnerability in ZTE Z80 Ultra product -
CVE-2026-86556
An information disclosure vulnerability in ZTE U30 Air produ
Same weakness: CWE-89
-
CVE-2026-96653
WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL -
CVE-2026-96662
Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL In -
CVE-2026-107712
WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) S -
CVE-2026-104023
Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administ -
CVE-2026-104724
FireBox <= 3.1.13 - Authenticated (Author+) SQL Injection vi
V. Comments for CVE-2026-49004
No comments yet