Vulnerability · Published Apr 17, 2026 · Assigned by zte
CVE-2026-40002ZTE Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations.
Medium 5.0
In plain English
A medium-severity privilege mismanagement in Red Magic 11 Pro (NX809J) from ZTE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.1%top 98.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations. The vulnerability stems from the lack of validation for applications accessing the service interface. Exploiting this vulnerability, an attacker can write files to specific partitions and set writable system properties.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ZTE | Red Magic 11 Pro (NX809J) | GEN_NEEA_NX809J V1.0.0B14MR1 – through V1.0.0B14MR1 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L