HarmonyOS vulnerabilities
234 known vulnerabilities in HarmonyOS from Huawei. 234 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
HarmonyOS: Improper Restriction of Excessive Authentication Attempts
Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability of package names' public keys not being verified in the security module.Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Inadequate Encryption Strength
Vulnerability of 5G messages being sent without being encrypted in a VPN environment in the SMS message module. Successful exploitation of this vulnerability may affect confidentiality.
- 7.5 High severity
HarmonyOS: NULL Pointer Dereference
Stability-related vulnerability in the binder background management and control module. Successful exploitation of this vulnerability may affect availability.
- 7.5 High severity
HarmonyOS: Improper Neutralization of Special Elements used in a Command
Command injection vulnerability in the distributed file system module. Successful exploitation of this vulnerability may cause variables in the sock structure to be modified.
- 7.5 High severity
HarmonyOS: Improper Limitation of a Pathname to a Restricted Directory
Redirection permission verification vulnerability in the home screen module. Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5 High severity
Vulnerability of parameters not being strictly verified in the PMS module.
Vulnerability of parameters not being strictly verified in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.
- 9.8 Critical severity
Input verification vulnerability in the fingerprint module.
Input verification vulnerability in the fingerprint module. Successful exploitation of this vulnerability will affect confidentiality, integrity, and availability.
- 7.5 High severity
Vulnerability of input parameter verification in certain APIs in the window management module.
Vulnerability of input parameter verification in certain APIs in the window management module. Successful exploitation of this vulnerability may cause the device to restart.
- 9.1 Critical severity
HarmonyOS: Improperly Implemented Security Check for Standard
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
- 9.1 Critical severity
HarmonyOS: Improper Limitation of a Pathname to a Restricted Directory
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
- 9.1 Critical severity
HarmonyOS: Improper Limitation of a Pathname to a Restricted Directory
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
- 9.1 Critical severity
HarmonyOS: Improper Limitation of a Pathname to a Restricted Directory
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
- 9.1 Critical severity
Parameter verification vulnerability in the installd module.
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
- 9.1 Critical severity
Parameter verification vulnerability in the installd module.
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
- 7.5 High severity
Mismatch vulnerability in the serialization process in the communication system.
Mismatch vulnerability in the serialization process in the communication system. Successful exploitation of this vulnerability may affect availability.
- 7.5 High severity
Vulnerability of API privilege escalation in the wifienhance module.
Vulnerability of API privilege escalation in the wifienhance module. Successful exploitation of this vulnerability may cause the arp list to be modified.
- 7.5 High severity
Vulnerability of input parameter verification in certain APIs in the window management module.
Vulnerability of input parameter verification in certain APIs in the window management module. Successful exploitation of this vulnerability may cause the device to restart.
- 7.5 High severity
Vulnerability of input parameters being not strictly verified in the PMS module.
Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause newly installed apps to fail to restart.
- 9.1 Critical severity
Vulnerability of configuration defects in the media module of certain products..
Vulnerability of configuration defects in the media module of certain products.. Successful exploitation of this vulnerability may cause unauthorized access.
- 9.8 Critical severity
HarmonyOS: Out-of-bounds Write
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Successful exploitation of this vulnerability may cause other apps to be executed with escalated privileges.
- 7.5 High severity
HarmonyOS: Improper Verification of Cryptographic Signature
Vulnerability of insecure signatures in the ServiceWifiResources module. Successful exploitation of this vulnerability may cause ServiceWifiResources to be maliciously modified and overwritten.
- 7.5 High severity
HarmonyOS: Improper Verification of Cryptographic Signature
Vulnerability of insecure signatures in the OsuLogin module. Successful exploitation of this vulnerability may cause OsuLogin to be maliciously modified and overwritten.
- 7.5 High severity
Vulnerability of input parameters being not strictly verified in the PMS module.
Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause home screen unavailability.
- 7.5 High severity
Vulnerability of input parameters being not strictly verified in the PMS module.
Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause home screen unavailability.
- 7.5 High severity
HarmonyOS: Incorrect Authorization
Vulnerability of incomplete permission verification in the input method module. Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5 High severity
HarmonyOS: Exposure of Resource to Wrong Sphere
Vulnerability of input parameters being not strictly verified in the AMS module. Successful exploitation of this vulnerability may compromise apps' data security.
- 9.1 Critical severity
HarmonyOS: Buffer Copy without Checking Size of Input
Buffer overflow vulnerability in the modem pinctrl module. Successful exploitation of this vulnerability may affect the integrity and availability of the modem.
- 9.8 Critical severity
HarmonyOS: Authorization Bypass Through User-Controlled Key
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Attackers may exploit this vulnerability to rewrite the non-volatile random-access memory (NVRAM), or facilitate the exploitation of other vulnerabilities.
- 9.1 Critical severity
HarmonyOS: Out-of-bounds Read
Vulnerability of missing input length verification in the distributed file system. Successful exploitation of this vulnerability may cause out-of-bounds read.
- 7.5 High severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
Format string vulnerability in the distributed file system. Attackers who bypass the selinux permission can exploit this vulnerability to crash the program.
- 7.5 High severity
HarmonyOS: NULL Pointer Dereference
Vulnerability of incomplete input parameter verification in the communication framework module. Successful exploitation of this vulnerability may affect availability.
- 7.5 High severity
HarmonyOS: Improper Handling of Exceptional Conditions
Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5 High severity
HarmonyOS: Uncaught Exception
Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5 High severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability that a unique value can be obtained by a third-party app in the DSoftBus module. Successful exploitation of this vulnerability will affect confidentiality.
- 7.5 High severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
The Sepolicy module has inappropriate permission control on the use of Netlink.Successful exploitation of this vulnerability may affect confidentiality.
- 9.8 Critical severity
HarmonyOS: Authentication Bypass by Spoofing
Vulnerability of identity verification being bypassed in the Gallery module. Successful exploitation of this vulnerability may cause out-of-bounds access.
- 9.8 Critical severity
HarmonyOS: Use After Free
Use After Free (UAF) vulnerability in the Vdecoderservice service. Successful exploitation of this vulnerability may cause the image decoding feature to perform abnormally.
- 9.8 Critical severity
HarmonyOS: Use After Free
Use After Free (UAF) vulnerability in the audio PCM driver module under special conditions. Successful exploitation of this vulnerability may cause audio features to perform abnormally.
- 7.5 High severity
HarmonyOS: Authentication Bypass by Capture-replay
Vulnerability of identity verification being bypassed in the storage module. Successful exploitation of this vulnerability may affect service confidentiality.