VulnerabilityPublished 20 Oct 2025

CVE-2025-57838: Honor MagicOS · Information Exposure

Affects Honor MagicOSSource CVE Database V5

Not known to be exploited · CVSS 4.0 Medium.

Data as of 26 Oct 2026, 12:55 UTC

CVSS 3.1 base score

4.0Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector: Local
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 20 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Restrict physical and logical local access to Honor devices running MagicOS by enforcing strict device usage policies and access controls.
Employ full-disk encryption and strong device authentication mechanisms to reduce the risk of unauthorized local data access.
Monitor devices for signs of unauthorized access or malware that could exploit local vulnerabilities.
Educate users on the importance of safeguarding their devices from loss or theft.
Maintain an inventory of all Honor devices in use and track their security status.
Apply security updates and patches from Honor promptly once they become available to address this vulnerability.
Consider deploying mobile device management (MDM) solutions that can enforce security policies and remotely wipe compromised devices.
Limit the installation of untrusted applications that could gain local execution capabilities and exploit the vulnerability.
Conduct regular security assessments and penetration tests focusing on mobile device security within the organization.

Description

CVE-2025-57838 is an information disclosure vulnerability in Honor's MagicOS that allows unauthorized local attackers to access sensitive information without authentication or user interaction. The vulnerability has a medium severity with a CVSS score of 4.0, indicating limited confidentiality impact and no effect on integrity or availability. Exploitation requires local access but no privileges or user interaction, making it a concern primarily for devices physically or logically accessible to attackers. There are no known exploits in the wild, and no patches have been released yet. European organizations using Honor devices with MagicOS could face confidentiality risks if attackers gain local access. Mitigation should focus on restricting local access, monitoring device usage, and applying vendor updates once available. Countries with higher Honor device market penetration and strategic interest in mobile security, such as Germany, France, Spain, and the UK, are more likely to be affected. Overall, the threat is medium severity due to limited impact scope and exploitation complexity.

Impact

For European organizations, the primary impact of CVE-2025-57838 lies in the potential exposure of sensitive information stored on or processed by Honor devices running MagicOS. This could lead to confidentiality breaches affecting personal data, corporate credentials, or proprietary information. Although the vulnerability does not affect integrity or availability, the leakage of sensitive data could facilitate further attacks such as identity theft, corporate espionage, or targeted phishing campaigns. The requirement for local access limits the attack surface, but in environments where devices are shared, lost, or physically accessible to unauthorized personnel, the risk increases. Organizations relying on Honor devices for communication or data storage should be aware of this risk, especially in sectors handling sensitive or regulated data such as finance, healthcare, and government. The absence of known exploits reduces immediate risk but does not eliminate the threat, particularly as attackers may develop exploits once the vulnerability becomes public knowledge.

Summary

CVE-2025-57838 is a vulnerability classified under CWE-200, indicating an exposure of sensitive information to unauthorized actors within Honor's MagicOS operating system. MagicOS is the proprietary OS used on Honor smartphones and related devices. This vulnerability allows an attacker with local access to the device to obtain sensitive information without requiring any privileges or user interaction. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects that the attack vector is local, with low attack complexity, no privileges required, and no user interaction needed. The scope remains unchanged, and the impact is limited to confidentiality, with no impact on integrity or availability. The vulnerability was reserved in August 2025 and published in October 2025, with no known exploits in the wild or patches currently available. The lack of required privileges or user interaction means that any unauthorized local user or malware with local execution capabilities could potentially extract sensitive data from the device, which could include personal information, credentials, or other confidential data stored or processed by MagicOS. This vulnerability poses a risk especially in scenarios where devices might be lost, stolen, or accessed by malicious insiders or malware with local execution capabilities.

CWE-200Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #20OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design · Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
OWASP Cheat Sheets
Error Handling (opens in a new tab)
Logging (opens in a new tab)
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V8.3.4 (opens in a new tab)
V14.3.3 (opens in a new tab)
V7.3.3 (opens in a new tab)
Attack patterns
Subverting Environment Variable Values (opens in a new tab)
ICMP Echo Request Ping (opens in a new tab)
TCP SYN Scan (opens in a new tab)
Enumerate Mail Exchange (MX) Records (opens in a new tab)
DNS Zone Transfers (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

honor.com/global/security/cve-2025-57838/ (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 27 Oct 2025, 12:58 UTC

WeaknessesCWE-200

Technical details

References

Community reviews

Related threats