Huawei Emui vulnerabilities

CVE-2023-3455 [CRITICAL] CWE-200 CVE-2023-3455: Key management vulnerability on system. Successful exploitation of this vulnerability may affect ser Key management vulnerability on system. Successful exploitation of this vulnerability may affect service availability and integrity.

CVE-2020-9141 [CRITICAL] CWE-269 CVE-2020-9141: There is a improper privilege management vulnerability in some Huawei smartphone. Successful exploit There is a improper privilege management vulnerability in some Huawei smartphone. Successful exploitation of this vulnerability can cause information disclosure and malfunctions due to insufficient verification of data authenticity.

CVE-2023-52538 [CRITICAL] CWE-347 CVE-2023-52538: Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful ex Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability.

CVE-2021-40050 [CRITICAL] CWE-125 CVE-2021-40050: There is an out-of-bounds read vulnerability in the IFAA module. Successful exploitation of this vul There is an out-of-bounds read vulnerability in the IFAA module. Successful exploitation of this vulnerability may cause stack overflow.

CVE-2022-22256 [HIGH] CVE-2022-22256: The DFX module has an access control vulnerability.Successful exploitation of this vulnerability may The DFX module has an access control vulnerability.Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2021-37038 [HIGH] CVE-2021-37038: There is an Improper access control vulnerability in Huawei Smartphone.Successful exploitation of th There is an Improper access control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2021-40026 [HIGH] CWE-787 CVE-2021-40026: There is a Heap-based buffer overflow vulnerability in the AOD module in smartphones. Successful exp There is a Heap-based buffer overflow vulnerability in the AOD module in smartphones. Successful exploitation of this vulnerability may affect service integrity.

CVE-2021-40040 [HIGH] CVE-2021-40040: Vulnerability of writing data to an arbitrary address in the HW_KEYMASTER module. Successful exploit Vulnerability of writing data to an arbitrary address in the HW_KEYMASTER module. Successful exploitation of this vulnerability may affect confidentiality.

CVE-2022-41591 [HIGH] CWE-22 CVE-2022-41591: The backup module has a path traversal vulnerability. Successful exploitation of this vulnerability The backup module has a path traversal vulnerability. Successful exploitation of this vulnerability causes unauthorized access to other system files.

CVE-2021-36986 [CRITICAL] CVE-2021-36986: There is a vulnerability of tampering with the kernel in Huawei Smartphone.Successful exploitation o There is a vulnerability of tampering with the kernel in Huawei Smartphone.Successful exploitation of this vulnerability may escalate permissions.

CVE-2021-36989 [CRITICAL] CWE-276 CVE-2021-36989: There is a Kernel crash vulnerability in Huawei Smartphone.Successful exploitation of this vulnerabi There is a Kernel crash vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may escalate permissions.

CVE-2021-36990 [CRITICAL] CWE-276 CVE-2021-36990: There is a vulnerability of tampering with the kernel in Huawei Smartphone.Successful exploitation o There is a vulnerability of tampering with the kernel in Huawei Smartphone.Successful exploitation of this vulnerability may escalate permissions.

CVE-2023-49243 [HIGH] CVE-2023-49243: Vulnerability of unauthorized access to email attachments in the email module. Successful exploitati Vulnerability of unauthorized access to email attachments in the email module. Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2023-44115 [HIGH] CWE-200 CVE-2023-44115: Vulnerability of improper permission control in the Booster module. Impact: Successful exploitation Vulnerability of improper permission control in the Booster module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2023-44111 [HIGH] CWE-307 CVE-2023-44111: Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2023-49240 [HIGH] CWE-601 CVE-2023-49240: Unauthorized access vulnerability in the launcher module. Successful exploitation of this vulnerabil Unauthorized access vulnerability in the launcher module. Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2023-44096 [HIGH] CWE-287 CVE-2023-44096: Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2023-44097 [HIGH] CWE-200 CVE-2023-44097: Vulnerability of the permission to access device SNs being improperly managed.Successful exploitatio Vulnerability of the permission to access device SNs being improperly managed.Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2023-52540 [HIGH] CWE-287 CVE-2023-52540: Vulnerability of improper authentication in the Iaware module. Impact: Successful exploitation of th Vulnerability of improper authentication in the Iaware module. Impact: Successful exploitation of this vulnerability will affect availability.

CVE-2023-39394 [HIGH] CWE-264 CVE-2023-39394: Vulnerability of API privilege escalation in the wifienhance module. Successful exploitation of this Vulnerability of API privilege escalation in the wifienhance module. Successful exploitation of this vulnerability may cause the arp list to be modified.