CVE-2026-40002 is an improper privilege management vulnerability (CWE-269) in the ZTE Red Magic 11 Pro (NX809J) device. It arises because the device does not properly validate which applications can access a sensitive service interface. This allows non-privileged applications to perform sensitive operations such as writing files to specific partitions and setting writable system properties. The vulnerability affects the specified firmware version and has a CVSS 3.1 score of 5.0, indicating medium severity. No vendor advisory or patch information is currently available, and it is not a cloud service.

Exploitation of this vulnerability could allow a local attacker with limited privileges to perform unauthorized file writes to certain partitions and modify system properties, potentially leading to partial compromise of system integrity and confidentiality. The CVSS vector indicates that the attack requires local access, high attack complexity, low privileges, and user interaction, with impacts on confidentiality, integrity, and availability rated as low to medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict installation of untrusted applications and limit local access to the device to reduce risk. Monitor vendor communications for updates on patches or official mitigations.