PT-2026-33421 · Zte · Red Magic 11 Pro

Christopher Nelson · Published 2026-04-17 · Updated 2026-04-17 · CVE-2026-40002

Mitre

CVSS v3.1

5.0

Medium

AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations. The vulnerability stems from the lack of validation for applications accessing the service interface. Exploiting this vulnerability, an attacker can write files to specific partitions and set writable system properties.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-40002

Affected Products

Red Magic 11 Pro

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-40002 · Security Note
• https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/8224335890517684583 · Note
• https://twitter.com/CVEnew/status/2045102598328307742 · Twitter Post