Huawei Harmonyos vulnerabilities

CVE-2023-46771 [HIGH] CWE-269 CVE-2023-46771: Security vulnerability in the face unlock module. Successful exploitation of this vulnerability may Security vulnerability in the face unlock module. Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2023-41293 [HIGH] CWE-227 CVE-2023-41293: Data security classification vulnerability in the DDMP module. Successful exploitation of this vulne Data security classification vulnerability in the DDMP module. Successful exploitation of this vulnerability may affect confidentiality.

CVE-2025-53169 [HIGH] CWE-287 CVE-2025-53169: Vulnerability of bypassing the process to start SA and use related functions on distributed cameras Vulnerability of bypassing the process to start SA and use related functions on distributed cameras Impact: Successful exploitation of this vulnerability may allow the peer device to use the camera without user awareness.

CVE-2022-48350 [HIGH] CWE-862 CVE-2022-48350: The HUAWEI Messaging app has a vulnerability of unauthorized file access. Successful exploitation of The HUAWEI Messaging app has a vulnerability of unauthorized file access. Successful exploitation of this vulnerability may affect confidentiality.

CVE-2023-39383 [HIGH] CWE-200 CVE-2023-39383: Vulnerability of input parameters being not strictly verified in the AMS module. Successful exploita Vulnerability of input parameters being not strictly verified in the AMS module. Successful exploitation of this vulnerability may compromise apps' data security.

CVE-2022-48298 [HIGH] CWE-1284 CVE-2022-48298: The geofencing kernel code does not verify the length of the input data. Successful exploitation of The geofencing kernel code does not verify the length of the input data. Successful exploitation of this vulnerability may cause out-of-bounds memory access.

CVE-2022-44561 [HIGH] CWE-276 CVE-2022-44561: The preset launcher module has a permission verification vulnerability. Successful exploitation of t The preset launcher module has a permission verification vulnerability. Successful exploitation of this vulnerability makes unauthorized apps add arbitrary widgets and shortcuts without interaction.

CVE-2024-58107 [HIGH] CWE-680 CVE-2024-58107: Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerabil Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2023-52388 [HIGH] CWE-732 CVE-2023-52388: Permission control vulnerability in the clock module. Impact: Successful exploitation of this vulner Permission control vulnerability in the clock module. Impact: Successful exploitation of this vulnerability will affect availability.

CVE-2023-52105 [HIGH] CWE-269 CVE-2023-52105: The nearby module has a privilege escalation vulnerability. Successful exploitation of this vulnerab The nearby module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect availability.

CVE-2024-27897 [HIGH] CWE-200 CVE-2024-27897: Input verification vulnerability in the call module. Impact: Successful exploitation of this vulnera Input verification vulnerability in the call module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2022-48508 [HIGH] CWE-264 CVE-2022-48508: Inappropriate authorization vulnerability in the system apps. Successful exploitation of this vulne Inappropriate authorization vulnerability in the system apps. Successful exploitation of this vulnerability may affect service integrity.

CVE-2023-52539 [HIGH] CWE-285 CVE-2023-52539: Permission verification vulnerability in the Settings module. Impact: Successful exploitation of thi Permission verification vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2024-54119 [HIGH] CWE-200 CVE-2024-54119: Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation o Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2024-54104 [HIGH] CWE-264 CVE-2024-54104: Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation o Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2024-56448 [HIGH] CWE-94 CVE-2024-56448: Vulnerability of improper access control in the home screen widget module Impact: Successful exploit Vulnerability of improper access control in the home screen widget module Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2024-51523 [HIGH] CWE-840 CVE-2024-51523: Information management vulnerability in the Gallery module Impact: Successful exploitation of this v Information management vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2024-56443 [HIGH] CWE-200 CVE-2024-56443: Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation o Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2024-54121 [HIGH] CWE-20 CVE-2024-54121: Startup control vulnerability in the ability module Impact: Successful exploitation of this vulnerab Startup control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.

CVE-2024-57960 [HIGH] CWE-20 CVE-2024-57960: Input verification vulnerability in the ExternalStorageProvider module Impact: Successful exploitati Input verification vulnerability in the ExternalStorageProvider module Impact: Successful exploitation of this vulnerability may affect service confidentiality.