What’s Vulnerable › Vulnerabilities
CVE-2026-40002: ZTE Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations.
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-17 · updated 2026-10-26
- Weakness: CWE-269
Description
Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations. The vulnerability stems from the lack of validation for applications accessing the service interface. Exploiting this vulnerability, an attacker can write files to specific partitions and set writable system properties.
Affected products
- ZTE Red Magic 11 Pro (NX809J): before GEN_NEEA_NX809JV1.0.0B16MR1 — fixed in GEN_NEEA_NX809JV1.0.0B16MR1
How to fix
Upgrade to a fixed version: ZTE Red Magic 11 Pro (NX809J) GEN_NEEA_NX809JV1.0.0B16MR1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-40002 or the next vulnerability affects your stack