EUVD-2026-30825
GHSA-447q-fg75-99r5
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H
Lifecycle Timeline
1DescriptionNVD
A local privilege escalation vulnerability exists in O+ Connect because it fails to validate the identity of the caller on the pipe interface.
AnalysisAI
Local privilege escalation in OPPO's O+ Connect application stems from missing caller identity validation on a named pipe interface (CWE-266), allowing a low-privileged local user with user interaction to escalate to higher privileges with high availability impact and scope change. The CVSS 3.1 score is 7.3 and the issue was reported by OPPO itself; no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
24 hours: Identify and document all systems running OPPO O+ Connect; uninstall or disable the application on non-critical systems. 7 days: Restrict local system access through group policy; implement principle of least privilege for all user accounts; deploy endpoint monitoring for privilege escalation detection. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today