CVE-2025-48904 — Authentication Bypass Using an Alternate Path or Channel in Huawei Harmonyos

CWE-288 — Authentication Bypass Using an Alternate Path or Channel3 documents3 sources

Severity

6.2MEDIUMNVD

CNA4.4

EPSS

0.0%

top 90.00%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Huawei Harmonyos

Timeline

PublishedJun 6

Description

Vulnerability that cards can call unauthorized APIs in the FRS process Impact: Successful exploitation of this vulnerability may affect availability.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.5 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5huawei/harmonyos5.0.0

▶NVDhuawei/harmonyos5.0.0

🔴Vulnerability Details

CVEList

CVE-2025-48904: Vulnerability that cards can call unauthorized APIs in the FRS process Impact: Successful exploitation of this vulnerability may affect availability↗2025-06-06

▶

GHSA

GHSA-2h2w-vccm-6fx5: Vulnerability that cards can call unauthorized APIs in the FRS process Impact: Successful exploitation of this vulnerability may affect availability↗2025-06-06

▶