TECNO Pova 7 Pro 5G Command Injection Vulnerability Allowing Arbitrary Code Execution

A vulnerability in the AssistFeedbackService of the TECNO Pova 7 Pro 5G on Android has been identified, allowing local applications to execute arbitrary code with system privileges through command injection. This issue arises from improper handling of commands, which can be exploited by injecting malicious code that is then executed with elevated rights.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution on the device, potentially allowing malicious applications to perform actions or access data with system-level privileges.