Nx799J Red Magic 11 Air
Monthly
Local root escalation on the ZTE Nubia Red Magic 11 Air (NX799J) gaming smartphone stems from a built-in PostgreSQL service that runs as root, listens on a device port, and is guarded only by weak credentials. Because PostgreSQL's COPY FROM PROGRAM syntax executes OS commands with the server's privileges, any local app that reaches the database can break out of the Android application sandbox and run commands as root. No public exploit identified at time of analysis, though the technique (weak-cred Postgres plus COPY FROM PROGRAM) is well understood and trivially reproducible.
Local root escalation on the ZTE Nubia Red Magic 11 Air (NX799J) gaming smartphone stems from a built-in PostgreSQL service that runs as root, listens on a device port, and is guarded only by weak credentials. Because PostgreSQL's COPY FROM PROGRAM syntax executes OS commands with the server's privileges, any local app that reaches the database can break out of the Android application sandbox and run commands as root. No public exploit identified at time of analysis, though the technique (weak-cred Postgres plus COPY FROM PROGRAM) is well understood and trivially reproducible.