The ZTE Red Magic 11 Pro (NX809J) suffers from improper privilege management (CWE-269) due to a lack of validation on a service interface. This flaw enables non-privileged applications to invoke sensitive operations, including writing files to specific partitions and modifying writable system properties. The vulnerability affects the device version GEN_NEEA_NX809J V1.0.0B14MR1 and has a CVSS 3.1 base score of 5.0 (medium severity). No official remediation or patch has been provided by the vendor as of the publication date, and there are no known exploits in the wild.

An attacker with local access and limited privileges could exploit this vulnerability to write files to certain partitions and alter writable system properties, potentially impacting confidentiality, integrity, and availability to a limited extent. The CVSS vector indicates a local attack vector with high attack complexity, requiring user interaction, and resulting in low confidentiality, integrity, and availability impacts.

No official patch or remediation guidance is currently available from the vendor. Users and administrators should monitor vendor advisories for updates. Until a fix is released, limiting installation of untrusted applications and restricting local access may reduce risk.