The PostgreSQL service embedded in the ZTE NX799J (Red Magic 11 Air) device is vulnerable due to misconfiguration and command injection flaws. This service listens on a specific port with root privileges and weak authentication. The database's support for the COPY FROM PROGRAM syntax enables local attackers to execute arbitrary commands, bypassing Android's permission sandbox and escalating privileges to root. The vulnerability is classified as CWE-89 (SQL Injection). The CVSS 3.1 base score is 6.5, reflecting a medium severity with partial network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, low integrity impact, and low availability impact. The service is cloud-hosted, and a patch is available, though no explicit remediation details are provided.

Successful exploitation allows a local attacker to bypass Android's permission sandbox and gain full root access on the affected device. This compromises confidentiality, integrity, and availability to varying degrees, with the highest impact on confidentiality. The vulnerability could lead to unauthorized command execution with root privileges.

A patch is available for this vulnerability. Since the affected service is cloud-hosted, the vendor manages remediation server-side. Users and administrators should consult the vendor advisory for confirmation and ensure that the device firmware and software are updated to the latest patched versions. No additional mitigation guidance is provided in the advisory.