HarmonyOS vulnerabilities
234 known vulnerabilities in HarmonyOS from Huawei. 234 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.1 Critical severity
HarmonyOS: Improper Verification of Cryptographic Signature
Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability.
- 7.5 High severity
HarmonyOS: Improper Handling of Insufficient Permissions or Privileges
Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability.
- 7.5 High severity
HarmonyOS: Improper Authorization
Vulnerability of permission verification in some APIs in the ActivityTaskManagerService module. Impact: Successful exploitation of this vulnerability will affect availability.
- 7.5 High severity
HarmonyOS: Improper Handling of Insufficient Permissions or Privileges
Vulnerability of insufficient permission verification in the app management module. Impact: Successful exploitation of this vulnerability will affect availability.
- 7.5 High severity
HarmonyOS: Improper Limitation of a Pathname to a Restricted Directory
Path traversal vulnerability in the Bluetooth-based sharing module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Improper Privilege Management
Vulnerability of starting activities in the background in the ActivityManagerService (AMS) module. Impact: Successful exploitation of this vulnerability will affect availability.
- 7.5 High severity
HarmonyOS: Violation of Secure Design Principles
Vulnerability of defects introduced in the design process in the hwnff module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 7.7 High severity
HarmonyOS: Missing Authorization
Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
- 9.1 Critical severity
HarmonyOS: Incorrect Default Permissions
Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability.
- 7.5 High severity
HarmonyOS: Improper Neutralization of Special Elements used in an OS Command
Command injection vulnerability in the AccountManager module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Incorrect Permission Assignment for Critical Resource
Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability.
- 9.8 Critical severity
HarmonyOS: Improper Control of Generation of Code
Script injection vulnerability in the email module.Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability.
- 9.8 Critical severity
HarmonyOS: Protection Mechanism Failure
Vulnerability of incorrect service logic in the WindowManagerServices module.Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5 High severity
HarmonyOS: Missing Authentication for Critical Functionality
Vulnerability of missing authentication for critical functions in the Wi-Fi module.Successful exploitation of this vulnerability may affect service confidentiality.
- 7.4 High severity
HarmonyOS: Out-of-bounds Read
Vulnerability of input data not being verified in the cellular data module.Successful exploitation of this vulnerability may cause out-of-bounds access.
- 7.5 High severity
HarmonyOS: Improper Preservation of Permissions
Vulnerability of permission verification in the content sharing pop-up module.Successful exploitation of this vulnerability may cause unauthorized file sharing.
- 7.7 High severity
HarmonyOS: Improper Access Control
Vulnerability of improper access control in the media library module.Successful exploitation of this vulnerability may affect service availability and integrity.
- 7.5 High severity
HarmonyOS: Buffer Copy without Checking Size of Input
Out-of-bounds read vulnerability in the smart activity recognition module.Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5 High severity
HarmonyOS: Deserialization of Untrusted Data
Vulnerability of serialization/deserialization mismatch in the vibration framework.Successful exploitation of this vulnerability may affect availability.
- 7.5 High severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability of foreground service restrictions being bypassed in the NMS module.Successful exploitation of this vulnerability may affect service confidentiality.
- 9.1 Critical severity
Vulnerability of permission verification for APIs in the DownloadProviderMain module.
Vulnerability of permission verification for APIs in the DownloadProviderMain module. Impact: Successful exploitation of this vulnerability will affect integrity and availability.
- 7.5 High severity
HarmonyOS: Improper Access Control
Vulnerability of foreground service restrictions being bypassed in the NMS module. Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Incorrect Permission Assignment for Critical Resource
Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the device.
- 7.5 High severity
HarmonyOS: Incorrect Permission Assignment for Critical Resource
Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Insufficient Verification of Data Authenticity
Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Authentication Bypass by Spoofing
Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Authentication Bypass by Spoofing
Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Missing Authorization
Vulnerability of missing permission verification for APIs in the Designed for Reliability (DFR) module. Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Improper Privilege Management
Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the device.
- 7.5 High severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
The remote PIN module has a vulnerability that causes incorrect information storage locations.Successful exploitation of this vulnerability may affect confidentiality.
- 7.5 High severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability of improper permission control in the Booster module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 9.1 Critical severity
HarmonyOS: Authentication Bypass by Spoofing
Vulnerability of identity verification being bypassed in the face unlock module. Successful exploitation of this vulnerability will affect integrity and confidentiality.
- 7.5 High severity
HarmonyOS: Out-of-bounds Write
Out-of-bounds vulnerability in the sensor module. Successful exploitation of this vulnerability may cause mistouch prevention errors on users' mobile phones.
- 9.1 Critical severity
HarmonyOS: Improper Access Control
Vulnerability of undefined permissions in the MeeTime module.Successful exploitation of this vulnerability will affect availability and confidentiality.
- 9.8 Critical severity
HarmonyOS: Missing Authentication for Critical Functionality
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this vulnerability may cause some apps to run without being authorized.
- 9.8 Critical severity
HarmonyOS: Improper Privilege Management
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5 High severity
HarmonyOS: Improper Restriction of Excessive Authentication Attempts
Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.
- 9.8 Critical severity
HarmonyOS: Improper Privilege Management
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5 High severity
HarmonyOS: Exposure of Resource to Wrong Sphere
The Bluetooth module has a vulnerability in permission control for broadcast notifications.Successful exploitation of this vulnerability may affect confidentiality.
- 7.5 High severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability of the permission to access device SNs being improperly managed.Successful exploitation of this vulnerability may affect service confidentiality.