EMUI vulnerabilities
185 known vulnerabilities in EMUI from Huawei. 185 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
HarmonyOS: Missing Authentication for Critical Functionality
The hwPartsDFR module has a vulnerability in API calling verification. Successful exploitation of this vulnerability may affect device confidentiality.
- 7.5 High severity
HarmonyOS: Incorrect Authorization
The SDK for the MediaPlaybackController module has improper permission verification. Successful exploitation of this vulnerability may affect confidentiality.
- 9.1 Critical severity
HarmonyOS: Out-of-bounds Read
The HwPCAssistant module has the out-of-bounds read/write vulnerability. Successful exploitation of this vulnerability may affect confidentiality and integrity.
- 7.5 High severity
HarmonyOS: Improper Handling of Parameters
The SystemUI module has a vulnerability of repeated app restart due to improper parameters. Successful exploitation of this vulnerability may affect confidentiality.
- 7.8 High severity
HarmonyOS: Deserialization of Untrusted Data
The InputMethod module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
- 7.5 High severity
HarmonyOS: Incorrect Default Permissions
The facial recognition module has a vulnerability in file permission control. Successful exploitation of this vulnerability may affect confidentiality.
- 7.5 High severity
HarmonyOS: Improperly Controlled Modification of Dynamically-Determined Object Attributes
The recovery mode for updates has a vulnerability that causes arbitrary disk modification. Successful exploitation of this vulnerability may affect confidentiality.
- 7.4 High severity
HarmonyOS: URL Redirection to Untrusted Site
The BatteryHealthActivity has a redirection vulnerability. Successful exploitation of this vulnerability by a malicious app can cause service exceptions.
- 7.5 High severity
HarmonyOS: Allocation of Resources Without Limits or Throttling
Some products have the double fetch vulnerability. Successful exploitation of this vulnerability may cause denial of service (DoS) attacks to the kernel.
- 7.5 High severity
The facial recognition module has a vulnerability in input parameter verification.
The facial recognition module has a vulnerability in input parameter verification. Successful exploitation of this vulnerability may cause failed facial recognition.
- 9.8 Critical severity
HarmonyOS: Improper Privilege Management
Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause kernel privilege escalation, which results in system service exceptions.
- 9.1 Critical severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
The MediaProvider module has a vulnerability of unauthorized data read. Successful exploitation of this vulnerability may affect confidentiality and integrity.
- 7.5 High severity
HarmonyOS: Missing Authorization
The AMS module has a vulnerability of lacking permission verification in APIs.Successful exploitation of this vulnerability may affect data confidentiality.
- 7.5 High severity
HarmonyOS: Improper Preservation of Permissions
The bundle management module lacks permission verification in some APIs. Successful exploitation of this vulnerability may restore the pre-installed apps that have been uninstalled.
- 7.5 High severity
HarmonyOS: Improper Validation of Specified Quantity in Input
The geofencing kernel code does not verify the length of the input data. Successful exploitation of this vulnerability may cause out-of-bounds memory access.
- 7.5 High severity
HarmonyOS: Improper Validation of Specified Quantity in Input
The geofencing kernel code has a vulnerability of not verifying the length of the input data. Successful exploitation of this vulnerability may cause out-of-bounds memory access.
- 7.5 High severity
HarmonyOS: Improper Preservation of Permissions
The IHwAntiMalPlugin interface lacks permission verification. Successful exploitation of this vulnerability can lead to filling problems (batch installation of applications).
- 7.5 High severity
HarmonyOS: Missing Authentication for Critical Functionality
The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affect data confidentiality.
- 7.5 High severity
HarmonyOS: Missing Authentication for Critical Functionality
The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affect data confidentiality.
- 7.5 High severity
HarmonyOS: Improper Privilege Management
The multi-screen collaboration module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
- 7.5 High severity
HarmonyOS: Improper Authentication
The DMSDP module of the distributed hardware has a vulnerability that may cause imposter control connections.Successful exploitation of this vulnerability may disconnect normal service connections.
- 7.5 High severity
HarmonyOS: Incorrect Default Permissions
The system has a vulnerability that may cause dynamic hiding and restoring of app icons.Successful exploitation of this vulnerability may cause malicious hiding of app icons.
- 9.8 Critical severity
HarmonyOS: Improper Privilege Management
Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause privilege escalation, which results in system service exceptions.
- 9.8 Critical severity
HarmonyOS: Out-of-bounds Write
Fingerprint calibration has a vulnerability of lacking boundary judgment. Successful exploitation of this vulnerability may cause out-of-bounds write.
- 7.5 High severity
HarmonyOS: Improper Authorization
The application management module has a vulnerability in permission verification. Successful exploitation of this vulnerability causes unexpected clear of device applications.
- 7.5 High severity
HarmonyOS: Deserialization of Untrusted Data
The system tool has inconsistent serialization and deserialization. Successful exploitation of this vulnerability will cause unauthorized startup of components.
- 9.8 Critical severity
HarmonyOS: Deserialization of Untrusted Data
The system framework layer has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
- 7.5 High severity
HarmonyOS: Incorrect Default Permissions
The preset launcher module has a permission verification vulnerability. Successful exploitation of this vulnerability makes unauthorized apps add arbitrary widgets and shortcuts without interaction.
- 9.8 Critical severity
HarmonyOS: Deserialization of Untrusted Data
The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
- 9.8 Critical severity
HarmonyOS: Deserialization of Untrusted Data
The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
- 7.5 High severity
HarmonyOS: Incorrect Default Permissions
The SmartTrimProcessEvent module has a vulnerability of obtaining the read and write permissions on arbitrary system files. Successful exploitation of this vulnerability may affect data confidentiality.
- 7.5 High severity
HarmonyOS: Incorrect Default Permissions
The power module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause abnormal status of a module on the device.
- 9.8 Critical severity
HarmonyOS: Concurrent Execution using Shared Resource with Improper Synchronization
The iaware module has a vulnerability in thread security. Successful exploitation of this vulnerability will affect confidentiality, integrity, and availability.
- 7.5 High severity
HarmonyOS: Use After Free
The graphics display module has a UAF vulnerability when traversing graphic layers. Successful exploitation of this vulnerability may affect system availability.
- 7.5 High severity
HarmonyOS: Missing Authorization
The LBS module has a vulnerability in geofencing API access. Successful exploitation of this vulnerability may cause third-party apps to access the geofencing APIs without authorization, affecting user confidentiality.
- 7.5 High severity
HarmonyOS: Incomplete Cleanup
The kernel module has the vulnerability that the mapping is not cleared after the memory is automatically released. Successful exploitation of this vulnerability may cause a system restart.
- 7.5 High severity
HarmonyOS: Improper Check or Handling of Exceptional Conditions
The DFX unwind stack module of the ArkCompiler has a vulnerability in interface calling.Successful exploitation of this vulnerability affects system services and device availability.
- 7.5 High severity
HarmonyOS: Improper Handling of Length Parameter Inconsistency
The communication framework module has a vulnerability of not truncating data properly.Successful exploitation of this vulnerability may affect data confidentiality.
- 7.5 High severity
HarmonyOS: Out-of-bounds Read
The storage maintenance and debugging module has an array out-of-bounds read vulnerability.Successful exploitation of this vulnerability will cause incorrect statistics of this module.
- 9.1 Critical severity
HarmonyOS: Out-of-bounds Read
The HW_KEYMASTER module has a vulnerability of not verifying the data read.Successful exploitation of this vulnerability may cause malicious construction of data, which results in out-of-bounds access.