Executive brief
A security vulnerability in the OPPO O+ Connect application could allow a local user to gain elevated system privileges. O+ Connect is a tool used for connecting and managing mobile devices. If exploited, an attacker with limited access to a device could take control of more sensitive functions or disrupt the device's operations.
Technical details
A local privilege escalation vulnerability exists in OPPO O+ Connect due to improper validation of caller identities on its named pipe interface. The flaw is categorized as an incorrect privilege assignment (CWE-266). An attacker with local access and low-level privileges can interact with the vulnerable pipe interface to execute commands or perform actions with the higher privileges of the O+ Connect service. Exploitation requires minimal user interaction and can lead to a compromise of system integrity and availability. The vulnerability was disclosed by OPPO and is tracked as CVE-2026-22069.
Affected products
- OPPO O+ Connect
Timeline
- 2026-05-19: disclosed: Initial advisory publication by OPPO and NVD.