VulnerabilityDeferred

CVE-2026-49004

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities.

MEDIUM 6.5EPSS 0.61%

Does this matter?

Lower severity and a low EPSS score (0.61%). Track it; it rarely justifies an emergency change on its own.

Description

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing local attackers to bypass Android's permission sandbox and gain full root access.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
EPSS: 0.61% probability · 47th percentile
CISA KEV: Not listed
Weakness: CWE-89
Source: psirt@zte.com.cn

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/460174866982027405

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.