CVE-2026-49004
Received Received - Intake

PostgreSQL Command Injection on Mobile Device

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: ZTE Corporation

Description
The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing local attackers to bypass Android's permission sandbox and gain full root access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-49004
EUVD
EUVD-2026-53123

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zte postgresql *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a misconfigured PostgreSQL service on a mobile device running with root privileges and weak credentials. The database supports COPY FROM PROGRAM, which allows attackers to execute arbitrary commands and bypass Android's permission sandbox to gain full root access.

Detection Guidance

Check if PostgreSQL is running on the device by verifying if port 5432 or a custom port is open using netstat or ss commands. Look for PostgreSQL processes running with root privileges. Test for weak credentials by attempting default logins like postgres/postgres or admin/admin.

Impact Analysis

An attacker could exploit this to gain complete control over the device, access sensitive data, install malware, or perform unauthorized actions with root-level permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information, potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Disable the PostgreSQL service on the mobile device if not required. Change default credentials to strong passwords. Restrict network access to the PostgreSQL port using firewall rules. Disable the COPY FROM PROGRAM feature in PostgreSQL configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49004. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart