This vulnerability in Huawei HarmonyOS arises from insufficient permission controls in call handling, leading to potential unauthorized exposure of sensitive information (CWE-200). The CVSS vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. Affected versions include 4.0.0, 4.2.0, 4.3.0, and 4.3.1. No vendor advisory or patch is currently available, and no known exploitation has been reported.

Successful exploitation could lead to unauthorized disclosure of sensitive information and may affect system availability to a limited extent. The medium CVSS score reflects moderate risk but does not indicate critical or high impact. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply standard security best practices and limit exposure of affected systems. Monitor Huawei's official channels for updates on patches or mitigations.