EUVD-2026-23388Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessTrick user into installing malicious app
-
DeliveryApp binds to unvalidated Red Magic service interface
-
ExploitInvoke privileged partition-write and property-set operations
-
ExecutionEscape app sandbox to system context
-
PersistPersist via written partition files
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have a non-privileged application installed and executing on the target Red Magic 11 Pro (NX809J) running firmware ≤V1.0.0B14MR1 - consistent with CVSS AV:L and PR:L. The concrete prerequisite from the description is reachability of the vulnerable service interface that lacks caller validation; the app then abuses it to write files to specific partitions and set writable system properties. Limiting factors: no remote or network exploitation is possible (local vector only), the victim must install and run attacker code on this exact model/firmware, and exploitation is not automatable per CISA SSVC. No UI interaction beyond running the app is needed (UI:N). |
| Impact | Signals are mixed and point to a real but non-urgent local issue rather than a mass-exploitation threat. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C, C:H/I:H/A:H) drives the 8.8 score primarily through the scope change and triple-high impact, but AV:L means the attacker must already have code running on the device (a locally installed app), which sharply limits reach compared to a network flaw. EPSS is 0.01% (0th percentile) and SSVC records Exploitation: none, Automatable: no, Technical Impact: partial - CISA's 'partial' technical impact is notably more conservative than NVD's C:H/I:H/A:H, a discrepancy worth flagging. There is no KEV listing and no POC identified. Net: this is a legitimate privilege-escalation weakness meaningful for a compromised or malicious-app threat model on this specific handset, but it is not a widespread-exploitation priority; the 8.8 overstates real-world urgency given local-only access and non-automatable exploitation. |
| Exploit ScenarioDerived | A user installs a seemingly benign app (e.g., a game utility or wallpaper app) that requests only ordinary permissions. Once running, the app connects to the unvalidated Red Magic system service interface and issues calls to write files into a protected partition and toggle writable system properties, escalating from sandboxed app context to system-level modification of the device. No user interaction beyond running the app is required, and no public exploit code is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 08, 2026
Local privilege escalation in the Red Magic 11 Pro (NX809J) gaming smartphone through firmware V1.0.0B14MR1 allows a non-privileged installed application to invoke a sensitive service interface that fails to validate its callers, letting the app write files to specific device partitions and set writable system properties. Reported by ZTE/Nubia through their own support bulletin, the issue is rated CVSS 8.8 with a scope change (S:C) reflecting the crossing of the app-sandbox privilege boundary into system context. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA SSVC records exploitation status as none.
Earlier versions of this analysis (2)
Local privilege escalation in the Red Magic 11 Pro (NX809J) gaming smartphone lets any non-privileged installed application invoke a sensitive service interface that fails to validate its callers. Through this exposed interface an attacker-controlled app can write files to specific device partitions and set writable system properties, effectively crossing from the app sandbox into privileged system state (CVSS 8.8, scope-changed). No public exploit has been identified at time of analysis, EPSS is negligible (0.01%), and CISA SSVC rates exploitation as 'none', indicating no observed in-the-wild activity.
Red Magic 11 Pro (NX809J) allows non-privileged applications to bypass service interface validation and write files to sensitive partitions or modify system properties, requiring local access with user interaction. The vulnerability impacts the integrity and availability of the device through privilege escalation from app-level access to system-level modifications, with a moderate CVSS score of 5.0 reflecting its local-only attack vector and requirement for user interaction.
RemediationAI
Update the Red Magic 11 Pro (NX809J) to the firmware version that supersedes V1.0.0B14MR1 as directed by ZTE's security bulletin (https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/8224335890517684583); no exact fixed build number is stated in the available data, so confirm the patched version directly with the vendor advisory before deploying. As compensating controls until patched, restrict app installation to trusted sources only (disable sideloading/unknown-sources installs, which reduces convenience for power users), avoid installing untrusted or low-reputation apps since exploitation requires attacker-controlled code on the device, and enterprise/MDM fleets should gate this model or enforce that no third-party APKs are permitted. Because the flaw is reachable by any local app, the only complete fix is the firmware update; the sideloading restrictions merely shrink the pool of potential malicious callers rather than closing the interface.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is an Android system service exposed by ZTE/Nubia's Red Magic firmware (CPE cpe:2.3:a:zte:red_magic_11_pro_(nx809j)) that offers a service interface (likely a bound Binder/AIDL service or exported provider) intended for privileged operations such as partition writes and system-property mutation. The root cause is CWE-269 (Improper Privilege Management): the service does not authenticate or authorize the calling application, so any third-party app running with ordinary, non-privileged Android permissions can reach operations that should be restricted to system/OEM-signed callers. On Android, writing to protected partitions and setting persistent/system-scoped properties normally requires system UID or SELinux domains far above an untrusted app, so the missing caller validation collapses that boundary.
Know when Red Magic 11 Pro Nx809J gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local malicious app (AV:L, PR:L) abuses unauthenticated service crossing the sandbox boundary (S:C); primary impact is partition writes and property changes (I:H/A:H) with limited data disclosure (C:L).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations. The vulnerability stems from the lack of validation for applications accessing the service interface. Exploiting this vulnerability, an attacker can write files to specific partitions and set writable system properties.
Executive ViewAI
Red Magic 11 Pro smartphones running firmware V1.0.0B14MR1 contain a high-severity local privilege escalation vulnerability (CVE-2026-40002, CVSS 8.8) allowing any installed application to cross the application sandbox boundary and gain system-level permissions. No public exploit identified at time of analysis. In BYOD or enterprise device scenarios, this vulnerability enables compromised or malicious applications to execute system-level operations, potentially exposing sensitive organizational data and device configuration.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce application allowlisting and disable sideloading via mobile device management; (2) disable developer modes and USB debugging; (3) restrict physical device access; (4) implement network segmentation to isolate these devices from sensitive systems and data; (5) monitor device logs for unauthorized system-level access or file modification operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
GitHub PoC
Exploit-DB