A command injection flaw in the AssistFeedbackService on TECNO Pova7 Pro 5G allows a local application to run arbitrary code with system privileges. This vulnerability can be leveraged to compromise the device, install malware, exfiltrate data, and modify system settings without user awareness.

The flaw is present only on TECNO Mobile’s Pova7 Pro 5G smartphone. No specific firmware or build identifiers are disclosed, so all units of this model may be affected unless a customer has upgraded to a patched firmware version.

The CVSS score of 7.8 indicates a significant impact, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, meaning no known widespread exploitation is recorded. The attack vector is inferred to be local: a malicious application installed on the device can trigger the service and execute code as system.