The vulnerability arises from a misconfigured PostgreSQL service that runs with root privileges and uses weak credentials. An attacker who can reach the service’s listening port can exploit the COPY FROM PROGRAM syntax, which permits arbitrary shell command execution. This allows the attacker to bypass Android’s permission sandbox and obtain full root access, effectively granting system‑wide control over the device.

The affected product is the ZTE NX799J, marketed as the Red Magic 11 Air. No version information is provided in the CNA data; users should verify that their device model matches this unit. The vulnerability is tied to the built‑in PostgreSQL instance rather than a specific firmware build.

With a CVSS score of 6.5, the severity is moderate. The EPSS score is not provided, but the lack of a KEV listing suggests no known widespread exploitation yet; however, the presence of root privileges, weak authentication, and a command injection vector implies that an evasion of Android’s sandbox is straightforward for a local attacker. The most likely attack vector is a local connection to the exposed PostgreSQL port from any process the device can run, meaning that any user or malicious app that can run code on the device could trigger the exploit.