CVE-2026-0634

Code Execution in AssistFeedbackService on TECNO Pova7 Pro 5G

State: Published
Severity: 7.8 High
Published: Apr 2, 2026
Updated: Apr 2, 2026
Reserved: Jan 6, 2026

Description

Code execution in AssistFeedbackService of TECNO Pova7 Pro 5G on Android allows local apps to execute arbitrary code as system via command injection.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-88 Improper neutralization of argument delimiters in a command ('argument injection')

Affected Products

Product	Versions
TECNO Pova7 Pro 5GTECNO Mobile	HiOS V15.1.0Affected

References

https://security.tecno.com/SRC/securityUpdates

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.