CVE-2026-40002

HighCVSS 8.8/10Last modified Jul 8, 2026

Description

Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations. The vulnerability stems from the lack of validation for applications accessing the service interface. Exploiting this vulnerability, an attacker can write files to specific partitions and set writable system properties.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Apr 17, 2026
Last modified: Jul 8, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-400036.8ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target addres CVE-2026-400047.8There exists an openssl.cnf privilege escalation vulnerability in ZTE Cloud PC client uSmartview. An attacker can execute arbitrary code loc CVE-2026-400059.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. An attacker can write arbitrar CVE-2026-400067.5Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Funct CVE-2026-400077.5Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB CVE-2026-400089.8Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a CVE-2026-400096.5Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path acc CVE-2026-40019.8The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, CVE-2026-400109.1Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack i CVE-2026-400113.7An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing inval CVE-2026-400125.3ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;CVE-2026-400134.3An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write