Huawei Harmonyos vulnerabilities

CVE-2023-37242 [CRITICAL] CWE-639 CVE-2023-37242: Vulnerability of commands from the modem being intercepted in the atcmdserver module. Attackers may Vulnerability of commands from the modem being intercepted in the atcmdserver module. Attackers may exploit this vulnerability to rewrite the non-volatile random-access memory (NVRAM), or facilitate the exploitation of other vulnerabilities.

CVE-2021-37095 [CRITICAL] CWE-190 CVE-2021-37095: There is a Integer Overflow or Wraparound vulnerability in Huawei Smartphone.Successful exploitation There is a Integer Overflow or Wraparound vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to remote denial of service and potential remote code execution.

CVE-2025-54617 [CRITICAL] CWE-121 CVE-2025-54617: Stack-based buffer overflow vulnerability in the dms_fwk module. Impact: Successful exploitation of Stack-based buffer overflow vulnerability in the dms_fwk module. Impact: Successful exploitation of this vulnerability can cause RCE.

CVE-2026-28536 [HIGH] CWE-305 CVE-2026-28536: Authentication bypass vulnerability in the device authentication module. Impact: Successful exploita Authentication bypass vulnerability in the device authentication module. Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.

CVE-2023-52381 [CRITICAL] CWE-94 CVE-2023-52381: Script injection vulnerability in the email module.Successful exploitation of this vulnerability may Script injection vulnerability in the email module.Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability.

CVE-2022-38983 [CRITICAL] CWE-416 CVE-2022-38983: The BT Hfp Client module has a Use-After-Free (UAF) vulnerability.Successful exploitation of this vu The BT Hfp Client module has a Use-After-Free (UAF) vulnerability.Successful exploitation of this vulnerability may result in arbitrary code execution.

CVE-2024-58124 [CRITICAL] CWE-290 CVE-2024-58124: Access control vulnerability in the security verification module Impact: Successful exploitation of Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.

CVE-2024-58126 [CRITICAL] CWE-290 CVE-2024-58126: Access control vulnerability in the security verification module Impact: Successful exploitation of Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.

CVE-2024-58127 [CRITICAL] CWE-290 CVE-2024-58127: Access control vulnerability in the security verification module Impact: Successful exploitation of Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.

CVE-2025-31170 [CRITICAL] CWE-290 CVE-2025-31170: Access control vulnerability in the security verification module Impact: Successful exploitation of Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.

CVE-2024-58125 [CRITICAL] CWE-290 CVE-2024-58125: Access control vulnerability in the security verification module Impact: Successful exploitation of Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.

CVE-2025-48906 [HIGH] CWE-290 CVE-2025-48906: Authentication bypass vulnerability in the DSoftBus module Impact: Successful exploitation of this v Authentication bypass vulnerability in the DSoftBus module Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2021-37128 [CRITICAL] CWE-22 CVE-2021-37128: HwPCAssistant has a Path Traversal vulnerability .Successful exploitation of this vulnerability may HwPCAssistant has a Path Traversal vulnerability .Successful exploitation of this vulnerability may write any file.

CVE-2022-37003 [CRITICAL] CWE-276 CVE-2022-37003: The AOD module has a vulnerability in permission assignment. Successful exploitation of this vulnera The AOD module has a vulnerability in permission assignment. Successful exploitation of this vulnerability may cause permission escalation and unauthorized access to files.

CVE-2021-39979 [CRITICAL] CWE-94 CVE-2021-39979: HHEE system has a Code Injection vulnerability.Successful exploitation of this vulnerability may aff HHEE system has a Code Injection vulnerability.Successful exploitation of this vulnerability may affect HHEE system integrity.

CVE-2021-37040 [CRITICAL] CWE-88 CVE-2021-37040: There is a Parameter injection vulnerability in Huawei Smartphone.Successful exploitation of this vu There is a Parameter injection vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause privilege escalation of files after CIFS share mounting.

CVE-2021-46839 [CRITICAL] CWE-125 CVE-2021-46839: The HW_KEYMASTER module has a vulnerability of missing bounds check on length.Successful exploitatio The HW_KEYMASTER module has a vulnerability of missing bounds check on length.Successful exploitation of this vulnerability may cause malicious construction of data, which results in out-of-bounds access.

CVE-2023-41296 [CRITICAL] CWE-862 CVE-2023-41296: Vulnerability of missing authorization in the kernel module. Successful exploitation of this vulnera Vulnerability of missing authorization in the kernel module. Successful exploitation of this vulnerability may affect integrity and confidentiality.

CVE-2023-52953 [CRITICAL] CWE-22 CVE-2023-52953: Path traversal vulnerability in the Medialibrary module Impact: Successful exploitation of this vuln Path traversal vulnerability in the Medialibrary module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.

CVE-2026-49310 [HIGH] CWE-264 CVE-2026-49310: Permission control vulnerability in the event notification module. Impact: Successful exploitation o Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.