CVE-2026-49004 Overview
CVE-2026-49004 describes a command injection vulnerability in a built-in PostgreSQL service running on an affected ZTE mobile device. The database service listens on a specific network port, executes with root privileges, and is protected only by weak credentials. Because the PostgreSQL instance supports the COPY FROM PROGRAM syntax, a local attacker with database access can execute arbitrary operating system commands as root. This bypasses the Android permission sandbox and grants full control of the device. The vulnerability is tracked under [CWE-89] and requires physical or local access to the target device.
Critical Impact
A local attacker with low privileges can bypass the Android sandbox and gain root code execution on the mobile device through the exposed PostgreSQL service.
Affected Products
- ZTE mobile device with built-in PostgreSQL service (specific model not disclosed in the advisory)
- See the ZTE Security Bulletin for vendor details
Discovery Timeline
- 2026-08-05 - CVE-2026-49004 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-49004
Vulnerability Analysis
The affected mobile device ships with a PostgreSQL database service that is bound to a listening port and started under the root account. The service is protected by weak default credentials, allowing an attacker with local or physical access to authenticate to the database. Once authenticated, the attacker leverages PostgreSQL's COPY FROM PROGRAM feature to execute arbitrary shell commands. Because the database process runs as root, the resulting command execution occurs outside the Android application sandbox and inherits full system privileges. The classification maps to [CWE-89] for SQL command handling, though the practical impact is operating system command injection through a SQL primitive.
Root Cause
Three design failures combine to produce the vulnerability. First, a privileged database service is exposed on a reachable port on the device. Second, the service authenticates users with weak credentials that an attacker can guess or extract. Third, the database is configured to permit the COPY FROM PROGRAM statement, which invokes an operating system shell to run external programs during data import.
Attack Vector
Exploitation requires physical or on-device access with low privileges. An attacker connects to the local PostgreSQL listener, authenticates using the weak credentials, and issues a COPY ... FROM PROGRAM '<command>' statement. PostgreSQL executes the specified command with the privileges of the database process, which is root on the affected device. Refer to the ZTE Security Bulletin for vendor-specific technical details. No public proof-of-concept code is listed in the advisory.
Detection Methods for CVE-2026-49004
Indicators of Compromise
- Unexpected child processes spawned by the PostgreSQL server process, particularly shells such as /system/bin/sh or /bin/sh.
- PostgreSQL query logs containing COPY ... FROM PROGRAM statements originating from non-administrative sessions.
- New or modified files in system directories that would normally be read-only without root, indicating sandbox bypass.
- Outbound network connections from the PostgreSQL process to attacker-controlled infrastructure.
Detection Strategies
- Enable PostgreSQL statement logging and alert on any use of COPY FROM PROGRAM or COPY TO PROGRAM.
- Monitor process ancestry on the mobile device for shell or interpreter processes whose parent is the PostgreSQL daemon.
- Inspect authentication logs for repeated login attempts against the local database port, indicating credential guessing.
Monitoring Recommendations
- Forward mobile device telemetry, database logs, and process events to a centralized data lake for correlation and long-term retention.
- Baseline the set of processes that legitimately spawn from the database service and alert on deviations.
- Track use of the affected port on managed devices to identify unauthorized exposure.
How to Mitigate CVE-2026-49004
Immediate Actions Required
- Apply the vendor firmware update referenced in the ZTE Security Bulletin as soon as it is available for the affected model.
- Restrict physical access to affected devices, since the attack vector is local.
- Rotate any credentials or tokens stored on the device that may have been exposed during a suspected compromise.
- Inventory ZTE mobile devices in the environment and identify which run the vulnerable PostgreSQL component.
Patch Information
ZTE has published a security bulletin at ZTE Security Bulletin describing the affected products and remediation. Administrators should consult that bulletin for the specific firmware versions and update procedures relevant to their device model. The NVD entry lists the CVE as published on 2026-08-05 with no third-party patch mirror.
Workarounds
- Disable the built-in PostgreSQL service on the device if the functionality is not required.
- Bind the PostgreSQL listener to localhost only and block the port at the device firewall where configuration permits.
- Replace weak default credentials with strong, unique passwords and disable trust-based authentication in pg_hba.conf.
- Remove or restrict the pg_execute_server_program role membership so untrusted accounts cannot invoke COPY FROM PROGRAM.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
