CVE-2025-58304 is a permission control vulnerability identified in the file management module of Huawei's HarmonyOS, specifically affecting versions 5.0.1, 5.1.0, and 6.0.0. The vulnerability is classified under CWE-199, which pertains to Information Management Errors, indicating that the system improperly manages sensitive information, potentially exposing it to unauthorized parties. The flaw allows an attacker with network access and requiring user interaction—but no prior privileges—to exploit the vulnerability to compromise the confidentiality of services running on the affected devices. The CVSS 3.1 base score of 4.9 reflects a medium severity level, with the vector indicating that the attack vector is network-based (AV:P), attack complexity is low (AC:L), no privileges are required (PR:N), user interaction is required (UI:R), and the impact is high on confidentiality (C:H), low on integrity (I:L), and none on availability (A:N). The vulnerability does not currently have known exploits in the wild, but the potential for sensitive data leakage remains a concern. The absence of patches at the time of reporting suggests that organizations should implement interim mitigations and monitor for updates from Huawei. The vulnerability's presence in the file management module suggests that attackers might exploit improper permission checks or access controls to read or exfiltrate sensitive files or data managed by the system. Given Huawei's significant market presence in mobile and IoT devices, this vulnerability could have broad implications if exploited.

For European organizations, the primary impact of CVE-2025-58304 lies in the potential compromise of service confidentiality. Organizations using Huawei devices running the affected HarmonyOS versions—such as smartphones, tablets, or IoT devices—may face unauthorized disclosure of sensitive information managed by the file system. This could include corporate data, personal user information, or configuration files critical to service operation. The vulnerability does not affect integrity or availability significantly, but confidentiality breaches can lead to secondary impacts such as reputational damage, regulatory penalties under GDPR, and loss of competitive advantage. Sectors with high reliance on Huawei technology, including telecommunications, public administration, and critical infrastructure, may be particularly vulnerable. The requirement for user interaction reduces the risk of widespread automated exploitation but does not eliminate targeted attacks, especially spear-phishing or social engineering campaigns. The medium severity rating suggests that while the threat is not critical, it warrants timely attention to prevent escalation or chaining with other vulnerabilities.

1. Monitor Huawei’s official security advisories closely and apply patches or updates for HarmonyOS as soon as they become available to remediate the vulnerability. 2. Restrict network access to devices running affected HarmonyOS versions, especially limiting exposure to untrusted networks or the internet. 3. Implement strict access controls and permissions on file management operations to minimize the risk of unauthorized access. 4. Educate users about the risks of social engineering and the need to avoid interacting with suspicious prompts or links that could trigger exploitation. 5. Deploy network segmentation to isolate Huawei devices from critical systems and sensitive data repositories. 6. Use endpoint detection and response (EDR) tools to monitor for unusual file access patterns or unauthorized data exfiltration attempts. 7. Conduct regular security audits and vulnerability assessments focusing on Huawei device deployments to identify and mitigate potential attack vectors. 8. Consider alternative device or OS options in high-risk environments until the vulnerability is fully addressed.