What is the CVSS score of EUVD-2026-53123?

EUVD-2026-53123 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L. EPSS exploitation probability: 0.7%.

Which versions of Red Magic 11 Air are affected by EUVD-2026-53123?

The ZTE Nubia Red Magic 11 Air (NX799J) contains a critical local privilege escalation vulnerability (CVE-2026-49004, CVSS 10.0) that allows any installed application to gain root access through a…

How to fix or mitigate EUVD-2026-53123?

Within 24 hours: Conduct inventory of all ZTE Nubia Red Magic 11 Air (NX799J) devices in organizational use and document which contain sensitive data or access corporate systems. Within 7 days: Issue security advisory to affected device owners; implement device-level mitigations including restricting third-party app installation, disabling unused services where technically feasible, and isolating affected devices from critical network segments using MDM controls. Within 30 days: Develop and execute replacement strategy for all NX799J devices; establish contract requirement for vendor to provide security patches; implement endpoint monitoring to detect unauthorized root access attempts on any remaining devices.

Red Magic 11 Air EUVD-2026-53123

| CVE-2026-49004 MEDIUM

SQL Injection (CWE-89)

2026-08-05 zte

GHSA-v2vf-g6fh-j2m9

SQLi PostgreSQL Google Command Injection Zte Nx799J Red Magic 11 Air

6.5

CVSS 3.1 · Vendor: zte

Severity by source

Vendor (zte) PRIMARY

6.5 CRITICAL

AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

vuln.today AI

9.3 CRITICAL

Description indicates a local on-device app (AV:L) with no privileges or interaction reaching a weak-cred service; sandbox escape to root crosses a trust boundary (S:C) with full C/I/A loss.

3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (zte).

CVSS VectorVendor: zte

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Severity Changed

Aug 05, 2026 - 08:22 NVD

CRITICAL MEDIUM

CVSS changed

Aug 05, 2026 - 08:22 NVD

10.0 (CRITICAL) 6.5 (MEDIUM)

Analysis Generated

Aug 05, 2026 - 07:03 vuln.today

CVE Published

Aug 05, 2026 - 06:19 cve.org

CRITICAL 10.0

DescriptionCVE.org

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing local attackers to bypass Android's permission sandbox and gain full root access.

AnalysisAI

Local root escalation on the ZTE Nubia Red Magic 11 Air (NX799J) gaming smartphone stems from a built-in PostgreSQL service that runs as root, listens on a device port, and is guarded only by weak credentials. Because PostgreSQL's COPY FROM PROGRAM syntax executes OS commands with the server's privileges, any local app that reaches the database can break out of the Android application sandbox and run commands as root. No public exploit identified at time of analysis, though the technique (weak-cred Postgres plus COPY FROM PROGRAM) is well understood and trivially reproducible.

Technical ContextAI

The root cause is CWE-89 (SQL injection) leveraged against a bundled PostgreSQL instance shipped inside the phone firmware. PostgreSQL supports COPY ... FROM PROGRAM, a legitimate feature that pipes a shell command's output into a table; when the database superuser (or any role with the pg_execute_server_program privilege) issues it, the command runs as the OS account hosting the server. Here that account is root, and the service is exposed on a local port with weak/default credentials, so the SQL layer becomes a direct path to arbitrary OS command execution. Android's security model relies on per-app UID sandboxing; a root-owned network-listening service that any app can authenticate to defeats that boundary entirely. The single affected build per ENISA EUVD is GEN_CN_NX799JV1.0.0B15 (CPE cpe:2.3:a:zte:nx799j_(red_magic_11_air):*).

RemediationAI

Apply the firmware update referenced in ZTE's security bulletin (https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/460174866982027405) as soon as it is available; no exact fixed build number is stated in the provided data, so confirm the patched version directly with ZTE - the input identifies only affected build GEN_CN_NX799JV1.0.0B15. Because the flaw is baked into firmware, end-user workarounds are limited: users cannot easily alter a root-owned system service, but risk can be reduced by not installing untrusted apps (which would supply the required local foothold) and avoiding untrusted USB/ADB connections. For rooted/enterprise-managed devices, compensating controls include disabling or firewalling the PostgreSQL listener, rotating/strengthening the database credentials, and revoking the pg_execute_server_program privilege to neutralize COPY FROM PROGRAM - each of which may break firmware functionality that depends on the bundled database, so test before deploying.