CVE-2026-49004: PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product
The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing local attackers to bypass Android's permission sandbox and gain full root access.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49004?
The severity of CVE-2026-49004 is rated at 64, indicating a medium level of risk.
What kind of vulnerabilities does CVE-2026-49004 include?
CVE-2026-49004 includes misconfiguration flaws and command injection vulnerabilities within the PostgreSQL service.
How do I fix CVE-2026-49004?
To fix CVE-2026-49004, ensure that the PostgreSQL service is properly configured, restrict access using strong credentials, and disable the COPY FROM PROGRAM syntax if not needed.
Which product is affected by CVE-2026-49004?
CVE-2026-49004 affects the ZTE NX799J (Red Magic 11 Air) mobile device.
What actions can be taken to mitigate CVE-2026-49004?
Mitigation for CVE-2026-49004 includes securing the PostgreSQL service, strengthening the credentials, and managing permissions effectively.