Huawei vulnerabilities and threats

Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.

Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.

Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.

Multi-thread race condition vulnerability in the network management module. Impact: Successful exploitation of this vulnerability may affect availability.

Race condition vulnerability in the network module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect availability.

Input verification vulnerability in the compression and decompression module. Impact: Successful exploitation of this vulnerability may affect app data integrity.

Vulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerability may affect availability.

Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.

Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.

Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-64312 is a medium-severity permission control vulnerability in Huawei HarmonyOS's file management module that can lead to unauthorized exposure of sensitive information. It affects versions 5.0.1, 5.1.0, and 6.0.0. Exploitation requires network access and user interaction but no privileges, potentially compromising confidentiality with limited impact on integrity or availability. No known exploits are currently reported in the wild.

CVE-2025-58311 is a use-after-free (UAF) vulnerability found in the USB driver module of Huawei's HarmonyOS versions 4.0.0 through 5.1.0. Exploiting this vulnerability requires local access with high privileges and user interaction, and it has a medium severity with a CVSS score of 5.8. Successful exploitation can lead to a loss of system availability and partial confidentiality compromise. The vulnerability affects the integrity of memory management in the USB driver, potentially causing system crashes or unauthorized data exposure. No known exploits are currently reported in the wild, and no patches have been published yet.

CVE-2025-58308 is a high-severity vulnerability in Huawei HarmonyOS versions 5.0.1, 5.1.0, and 6.0.0, caused by an improperly implemented security check in the call module. Exploitation can lead to abnormal behavior of system features, impacting confidentiality, integrity, and availability. The vulnerability requires local access but no privileges or user interaction, making exploitation moderately challenging. There are no known exploits in the wild yet, and no patches have been released.

CVE-2025-58305 is an identity authentication bypass vulnerability in the Gallery app of Huawei HarmonyOS version 5.0.1. Exploitation of this flaw can lead to unauthorized access to sensitive information, impacting service confidentiality. The vulnerability has a CVSS score of 6.2, indicating a medium severity level. It requires local access (AV:L), no privileges (PR:N), and no user interaction (UI:N) to exploit, but it does not affect confidentiality, integrity, or availability directly according to the CVSS vector, which is inconsistent with the stated impact. No known exploits are currently reported in the wild. The vulnerability falls under CWE-200, which involves exposure of sensitive information to unauthorized actors. European organizations using Huawei devices running HarmonyOS 5.

CVE-2025-58304 is a medium severity permission control vulnerability in the file management module of Huawei's HarmonyOS versions 5.0.1, 5.1.0, and 6.0.0. Exploiting this flaw requires network access and user interaction but no privileges, potentially allowing attackers to compromise service confidentiality. The vulnerability is categorized under CWE-199 (Information Management Errors), indicating improper handling of sensitive information. While no known exploits are currently in the wild, successful exploitation could lead to unauthorized data disclosure.

CVE-2025-58302 is a high-severity permission control vulnerability in the Settings module of Huawei HarmonyOS affecting multiple versions from 2.0.0 to 4.3.1. The flaw allows unauthorized local attackers to gain elevated privileges without authentication or user interaction, potentially compromising confidentiality, integrity, and availability of system services. Exploitation requires local access but can lead to full system compromise. No known exploits are currently reported in the wild. European organizations using Huawei devices running HarmonyOS could face significant risks, especially in sectors relying on Huawei hardware. Mitigation involves applying vendor patches once available, restricting local access, and monitoring for suspicious activity.

CVE-2025-58294 is a medium severity permission control vulnerability in Huawei HarmonyOS print module affecting versions 5.0.1, 5.1.0, and 6.0.0. The flaw allows unauthorized local attackers to access confidential service data without requiring authentication or user interaction. Exploitation impacts confidentiality but does not affect integrity or availability. No known exploits are currently reported in the wild.

CVE-2025-64313 is a medium-severity denial of service (DoS) vulnerability in Huawei HarmonyOS affecting versions 5.0.1, 5.1.0, and 6.0.0. It arises from a race condition (CWE-362) in the office service component due to improper synchronization of shared resources. Exploitation requires local access with low privileges and some user interaction, potentially causing service unavailability. No known public exploits exist yet.

CVE-2025-64311 is a medium-severity permission control vulnerability in the Notepad module of Huawei HarmonyOS versions 5.0.1, 5.1.0, and 6.0.0. It allows unauthorized actors to access sensitive information without authentication or user interaction, impacting confidentiality but not integrity or availability. Exploitation requires local access with high attack complexity, limiting remote exploitation. No known exploits are currently in the wild.