The vulnerability arises from the lack of identity validation on a system pipe used by O+ Connect. An authenticated local attacker may exploit this to send specially crafted commands to the service, gaining privileges higher than the attacker’s original level. This represents a permissions management flaw (CWE‑266). The outcome can be full control over the device, enabling installation of malware or unauthorized changes that compromise confidentiality, integrity, and availability.

All devices running the OPPO O+ Connect application are potentially impacted. No specific version information is listed, so any installation of O+ Connect may be vulnerable until a patch is applied.

The CVSS score of 7.3 indicates high severity. The EPSS score is not available, but the local nature of the exploit means an attacker with physical or local access can elevate privileges without network exposure. The vulnerability is not listed in the CISA KEV catalog, yet the combination of high severity and local escalation potential makes it a significant risk. Rapid mitigation is advised.