Permission verification bypass vulnerability in the media library module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-68963 is a medium-severity vulnerability in Huawei's HarmonyOS version 4.3.1, caused by weak password requirements in the Clone module. This flaw enables a man-in-the-middle (MitM) attack that can compromise service confidentiality without impacting integrity or availability. Exploitation requires network-level access and some user interaction but no privileges. There are no known exploits in the wild, and no patches have been released yet. The vulnerability primarily threatens confidentiality by allowing attackers to intercept sensitive data during cloning operations. European organizations using HarmonyOS devices, especially those in sectors relying on Huawei technology, could be at risk. Mitigation involves enforcing stronger password policies, network segmentation, and monitoring for suspicious MitM activities. Countries with higher Huawei device adoption and strategic interest in Huawei technology, such as Germany, France, Italy, Spain, and the UK, are most likely affected.
CVE-2025-68967 is a medium severity vulnerability in Huawei HarmonyOS version 6.0.0 involving improper permission control in the print module. Exploitation requires local access and no user interaction but can lead to integrity and availability impacts with a scope that affects the system. The vulnerability does not impact confidentiality but can cause unauthorized modification or disruption of printing services. No known exploits are currently reported in the wild. European organizations using HarmonyOS devices, especially those relying on printing services, may face operational disruptions or data integrity issues. Mitigation requires Huawei to release patches and organizations to restrict local access and monitor print service usage. Countries with higher Huawei device adoption and strategic reliance on HarmonyOS are more likely to be affected. The CVSS score is 5.
Multi-thread race condition vulnerability in the thermal management module.
Impact: Successful exploitation of this vulnerability may affect availability.
Multi-thread race condition vulnerability in the camera framework module.
Impact: Successful exploitation of this vulnerability may affect availability.
Multi-thread race condition vulnerability in the camera framework module.
Impact: Successful exploitation of this vulnerability may affect availability.
Multi-thread race condition vulnerability in the video framework module.
Impact: Successful exploitation of this vulnerability may affect availability.
App lock verification bypass vulnerability in the file management app. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Permission control vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Permission control vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
