CVE-2026-40002

Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations. The vulnerability stems from the lack of validation for applications accessing the service interface. Exploiting this vulnerability, an attacker can write files to specific partitions and set writable system properties.

• CWE-269

• https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/8224335890517684583Vendor Advisory

Published

Apr 17, 2026

Last Modified

Jul 8, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39987marimo is a reactive Python notebook. Prior to 0.23.0, Marim…9.8
• CVE-2026-3999A broken access control may allow an authenticated user to p…8.8
• CVE-2026-39998Improper Input Validation vulnerability in Apache APISIX. T…8.8
• CVE-2026-39999Authentication Bypass by Spoofing vulnerability in Apache AP…9.1
• CVE-2026-40000The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewAc…1.8
• CVE-2026-40001There is a local privilege escalation vulnerability in the Z…5.2
• CVE-2026-40003ZTE ZX297520V3 BootROM contains a vulnerability that allows …6.8
• CVE-2026-40004There exists an openssl.cnf privilege escalation vulnerabili…7.8
• CVE-2026-40005Improper Limitation of a Pathname to a Restricted Directory …9.1
• CVE-2026-40006Memory Allocation with Excessive Size Value, Allocation of R…7.5
• CVE-2026-40007Uncontrolled Recursion, Uncontrolled Resource Consumption vu…7.5
• CVE-2026-40008Use of Externally-Controlled Input to Select Classes or Code…9.8