Huawei Harmonyos vulnerabilities

CVE-2023-44096 [HIGH] CWE-287 CVE-2023-44096: Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2023-44097 [HIGH] CWE-200 CVE-2023-44097: Vulnerability of the permission to access device SNs being improperly managed.Successful exploitatio Vulnerability of the permission to access device SNs being improperly managed.Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2023-52540 [HIGH] CWE-287 CVE-2023-52540: Vulnerability of improper authentication in the Iaware module. Impact: Successful exploitation of th Vulnerability of improper authentication in the Iaware module. Impact: Successful exploitation of this vulnerability will affect availability.

CVE-2023-39394 [HIGH] CWE-264 CVE-2023-39394: Vulnerability of API privilege escalation in the wifienhance module. Successful exploitation of this Vulnerability of API privilege escalation in the wifienhance module. Successful exploitation of this vulnerability may cause the arp list to be modified.

CVE-2023-52374 [HIGH] CWE-863 CVE-2023-52374: Permission control vulnerability in the package management module.Successful exploitation of this vu Permission control vulnerability in the package management module.Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2026-28552 [HIGH] CWE-19 CVE-2026-28552: Out-of-bounds write vulnerability in the IMS module. Impact: Successful exploitation of this vulnera Out-of-bounds write vulnerability in the IMS module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2022-48478 [CRITICAL] CVE-2022-48478: The facial recognition TA of some products lacks memory length verification. Successful exploitation The facial recognition TA of some products lacks memory length verification. Successful exploitation of this vulnerability may cause exceptions of the facial recognition service.

CVE-2024-9136 [HIGH] CWE-863 CVE-2024-9136: Access permission verification vulnerability in the App Multiplier module Impact: Successful exploit Access permission verification vulnerability in the App Multiplier module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2024-45450 [HIGH] CWE-200 CVE-2024-45450: Permission control vulnerability in the software update module. Impact: Successful exploitation of t Permission control vulnerability in the software update module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2026-34853 [HIGH] CWE-270 CVE-2026-34853: Permission bypass vulnerability in the LBS module. Impact: Successful exploitation of this vulnerabi Permission bypass vulnerability in the LBS module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2024-42036 [HIGH] CWE-285 CVE-2024-42036: Access permission verification vulnerability in the Notepad module Impact: Successful exploitation o Access permission verification vulnerability in the Notepad module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2021-37065 [CRITICAL] CWE-190 CVE-2021-37065: There is a Integer Overflow or Wraparound vulnerability in Huawei Smartphone.Successful exploitation There is a Integer Overflow or Wraparound vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Confidentiality or Availability impacted.

CVE-2021-37116 [CRITICAL] CWE-20 CVE-2021-37116: PCManager has a Weaknesses Introduced During Design vulnerability .Successful exploitation of this v PCManager has a Weaknesses Introduced During Design vulnerability .Successful exploitation of this vulnerability may cause that the PIN of the subscriber is changed.

CVE-2022-48312 [CRITICAL] CWE-125 CVE-2022-48312: The HwPCAssistant module has the out-of-bounds read/write vulnerability. Successful exploitation of The HwPCAssistant module has the out-of-bounds read/write vulnerability. Successful exploitation of this vulnerability may affect confidentiality and integrity.

CVE-2021-37086 [HIGH] CWE-281 CVE-2021-37086: There is a Improper Preservation of Permissions vulnerability in Huawei Smartphone.Successful exploi There is a Improper Preservation of Permissions vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers which can isolate and read synchronization files of other applications across the UID sandbox.

CVE-2025-48905 [HIGH] CWE-1068 CVE-2025-48905: Wasm exception capture vulnerability in the arkweb v8 module Impact: Successful exploitation of this Wasm exception capture vulnerability in the arkweb v8 module Impact: Successful exploitation of this vulnerability may cause the failure to capture specific Wasm exception types.

CVE-2021-40012 [HIGH] CVE-2021-40012: Vulnerability of pointers being incorrectly used during data transmission in the video framework. Su Vulnerability of pointers being incorrectly used during data transmission in the video framework. Successful exploitation of this vulnerability may affect confidentiality.

CVE-2021-37126 [HIGH] CWE-22 CVE-2021-37126: Arbitrary file has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability .Succe Arbitrary file has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability .Successful exploitation of this vulnerability may cause the directory is traversed.

CVE-2021-40063 [HIGH] CVE-2021-40063: There is an improper access control vulnerability in the video module. Successful exploitation of th There is an improper access control vulnerability in the video module. Successful exploitation of this vulnerability may affect confidentiality.

CVE-2021-37133 [HIGH] CVE-2021-37133: There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vu There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.