CVE-2026-40002 is an improper privilege management vulnerability (CWE-269) in the ZTE Red Magic 11 Pro (NX809J) device, specifically version GEN_NEEA_NX809J V1.0.0B14MR1. It arises from insufficient validation of application privileges when accessing a service interface, enabling non-privileged applications to trigger sensitive operations such as writing files to certain partitions and setting writable system properties. The vulnerability has a CVSS 3.1 base score of 5.0 (AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting a medium impact with local attack vector, high attack complexity, and requiring user interaction. No official remediation or patch is currently documented.

Exploitation of this vulnerability allows a local attacker with limited privileges and user interaction to perform sensitive operations, including writing files to specific partitions and modifying writable system properties. This can lead to partial confidentiality, integrity, and availability impacts on the affected device. However, the attack complexity is high, and the attacker must have local access and user interaction to exploit the flaw. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been provided by ZTE, users should monitor for vendor updates. Until a patch is available, restricting installation of untrusted applications and limiting local access to the device may reduce exposure.