Huawei Harmonyos vulnerabilities

CVE-2024-32992 [HIGH] CWE-20 CVE-2024-32992: Insufficient verification vulnerability in the baseband module Impact: Successful exploitation of th Insufficient verification vulnerability in the baseband module Impact: Successful exploitation of this vulnerability will affect availability.

CVE-2022-37006 [HIGH] CWE-276 CVE-2022-37006: Permission control vulnerability in the network module. Successful exploitation of this vulnerabilit Permission control vulnerability in the network module. Successful exploitation of this vulnerability may affect service availability.

CVE-2023-46758 [HIGH] CWE-269 CVE-2023-46758: Permission management vulnerability in the multi-screen interaction module. Successful exploitation Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the device.

CVE-2021-40030 [HIGH] CVE-2021-40030: The My HUAWEI app has a defect in the design. Successful exploitation of this vulnerability may affe The My HUAWEI app has a defect in the design. Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2022-46322 [HIGH] CWE-787 CVE-2022-46322: Some smartphones have the out-of-bounds write vulnerability. Successful exploitation of this vulnera Some smartphones have the out-of-bounds write vulnerability. Successful exploitation of this vulnerability may cause system service exceptions.

CVE-2022-44555 [HIGH] CWE-294 CVE-2022-44555: The DDMP/ODMF module has a service hijacking vulnerability. Successful exploit of this vulnerability The DDMP/ODMF module has a service hijacking vulnerability. Successful exploit of this vulnerability may cause services to be unavailable.

CVE-2023-34163 [HIGH] CVE-2023-34163: Permission control vulnerability in the window management module.Successful exploitation of this vul Permission control vulnerability in the window management module.Successful exploitation of this vulnerability may cause features to perform abnormally.

CVE-2023-34162 [HIGH] CVE-2023-34162: Version update determination vulnerability in the user profile module.Successful exploitation of thi Version update determination vulnerability in the user profile module.Successful exploitation of this vulnerability may cause repeated HMS Core updates and cause services to fail.

CVE-2022-41586 [HIGH] CWE-130 CVE-2022-41586: The communication framework module has a vulnerability of not truncating data properly.Successful ex The communication framework module has a vulnerability of not truncating data properly.Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2022-38981 [HIGH] CWE-125 CVE-2022-38981: The HwAirlink module has an out-of-bounds read vulnerability.Successful exploitation of this vulnera The HwAirlink module has an out-of-bounds read vulnerability.Successful exploitation of this vulnerability may cause information leakage.

CVE-2023-26549 [HIGH] CWE-233 CVE-2023-26549: The SystemUI module has a vulnerability of repeated app restart due to improper parameters. Successf The SystemUI module has a vulnerability of repeated app restart due to improper parameters. Successful exploitation of this vulnerability may affect confidentiality.

CVE-2024-32989 [HIGH] CWE-20 CVE-2024-32989: Insufficient verification vulnerability in the system sharing pop-up module Impact: Successful explo Insufficient verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability.

CVE-2023-34161 [HIGH] CWE-863 CVE-2023-34161: nappropriate authorization vulnerability in the SettingsProvider module.Successful exploitation of t nappropriate authorization vulnerability in the SettingsProvider module.Successful exploitation of this vulnerability may cause features to perform abnormally.

CVE-2022-48516 [HIGH] CWE-200 CVE-2022-48516: Vulnerability that a unique value can be obtained by a third-party app in the DSoftBus module. Succe Vulnerability that a unique value can be obtained by a third-party app in the DSoftBus module. Successful exploitation of this vulnerability will affect confidentiality.

CVE-2022-41599 [HIGH] CVE-2022-41599: The system service has a vulnerability that causes incorrect return values. Successful exploitation The system service has a vulnerability that causes incorrect return values. Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2022-46328 [HIGH] CWE-20 CVE-2022-46328: Some smartphones have the input validation vulnerability. Successful exploitation of this vulnerabil Some smartphones have the input validation vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2023-44095 [HIGH] CWE-416 CVE-2023-44095: Use-After-Free (UAF) vulnerability in the surfaceflinger module.Successful exploitation of this vuln Use-After-Free (UAF) vulnerability in the surfaceflinger module.Successful exploitation of this vulnerability can cause system crash.

CVE-2022-46310 [HIGH] CWE-200 CVE-2022-46310: The TelephonyProvider module has a vulnerability in obtaining values.Successful exploitation of this The TelephonyProvider module has a vulnerability in obtaining values.Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2023-1695 [HIGH] CWE-755 CVE-2023-1695: Vulnerability of failures to capture exceptions in the communication framework. Successful exploitat Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause features to perform abnormally.

CVE-2023-1691 [HIGH] CWE-248 CVE-2023-1691: Vulnerability of failures to capture exceptions in the communication framework. Successful exploitat Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause features to perform abnormally.