HarmonyOS vulnerabilities
234 known vulnerabilities in HarmonyOS from Huawei. 234 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
HarmonyOS: Uncontrolled Resource Consumption
Vulnerability of system restart triggered by abnormal callbacks passed to APIs.Successful exploitation of this vulnerability may cause the system to restart.
- 7.5 High severity
HarmonyOS: Incorrect Authorization
nappropriate authorization vulnerability in the SettingsProvider module.Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5 High severity
HarmonyOS: Improper Authentication
Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to become pre-authorized.
- 7.5 High severity
HarmonyOS: Improper Authentication
Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to become pre-authorized.
- 8.2 High severity
HarmonyOS: Incorrect Permission Assignment for Critical Resource
Vulnerability of undefined permissions in HUAWEI VR screen projection.Successful exploitation of this vulnerability will cause third-party apps to create windows in an arbitrary way, consuming system resources.
- 7.5 High severity
HarmonyOS: Missing Authentication for Critical Functionality
The hwPartsDFR module has a vulnerability in API calling verification. Successful exploitation of this vulnerability may affect device confidentiality.
- 7.5 High severity
HarmonyOS: Incorrect Authorization
The SDK for the MediaPlaybackController module has improper permission verification. Successful exploitation of this vulnerability may affect confidentiality.
- 9.8 Critical severity
HarmonyOS: Out-of-bounds Read
The facial recognition TA of some products has the out-of-bounds memory read vulnerability. Successful exploitation of this vulnerability may cause exceptions of the facial recognition service.
- 9.1 Critical severity
HarmonyOS: Out-of-bounds Read
The HwPCAssistant module has the out-of-bounds read/write vulnerability. Successful exploitation of this vulnerability may affect confidentiality and integrity.
- 7.5 High severity
HarmonyOS: Improper Handling of Parameters
The SystemUI module has a vulnerability of repeated app restart due to improper parameters. Successful exploitation of this vulnerability may affect confidentiality.
- 7.8 High severity
HarmonyOS: Deserialization of Untrusted Data
The InputMethod module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
- 7.5 High severity
HarmonyOS: Incorrect Default Permissions
The facial recognition module has a vulnerability in file permission control. Successful exploitation of this vulnerability may affect confidentiality.
- 7.5 High severity
HarmonyOS: Improperly Controlled Modification of Dynamically-Determined Object Attributes
The recovery mode for updates has a vulnerability that causes arbitrary disk modification. Successful exploitation of this vulnerability may affect confidentiality.
- 7.4 High severity
HarmonyOS: URL Redirection to Untrusted Site
The BatteryHealthActivity has a redirection vulnerability. Successful exploitation of this vulnerability by a malicious app can cause service exceptions.
- 7.5 High severity
HarmonyOS: Allocation of Resources Without Limits or Throttling
Some products have the double fetch vulnerability. Successful exploitation of this vulnerability may cause denial of service (DoS) attacks to the kernel.
- 7.5 High severity
The facial recognition module has a vulnerability in input parameter verification.
The facial recognition module has a vulnerability in input parameter verification. Successful exploitation of this vulnerability may cause failed facial recognition.
- 9.8 Critical severity
HarmonyOS: Improper Privilege Management
Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause kernel privilege escalation, which results in system service exceptions.
- 9.1 Critical severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
The MediaProvider module has a vulnerability of unauthorized data read. Successful exploitation of this vulnerability may affect confidentiality and integrity.
- 7.5 High severity
HarmonyOS: Missing Authorization
The AMS module has a vulnerability of lacking permission verification in APIs.Successful exploitation of this vulnerability may affect data confidentiality.
- 7.5 High severity
HarmonyOS: Improper Preservation of Permissions
The bundle management module lacks permission verification in some APIs. Successful exploitation of this vulnerability may restore the pre-installed apps that have been uninstalled.
- 7.5 High severity
HarmonyOS: Improper Validation of Specified Quantity in Input
The geofencing kernel code does not verify the length of the input data. Successful exploitation of this vulnerability may cause out-of-bounds memory access.
- 7.5 High severity
HarmonyOS: Improper Validation of Specified Quantity in Input
The geofencing kernel code has a vulnerability of not verifying the length of the input data. Successful exploitation of this vulnerability may cause out-of-bounds memory access.
- 7.5 High severity
HarmonyOS: Improper Preservation of Permissions
The IHwAntiMalPlugin interface lacks permission verification. Successful exploitation of this vulnerability can lead to filling problems (batch installation of applications).
- 9.1 Critical severity
HarmonyOS: Protection Mechanism Failure
The phone-PC collaboration module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data confidentiality and integrity.
- 7.5 High severity
HarmonyOS: Missing Authentication for Critical Functionality
The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affect data confidentiality.
- 7.5 High severity
HarmonyOS: Missing Authentication for Critical Functionality
The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affect data confidentiality.
- 7.5 High severity
HarmonyOS: Improper Privilege Management
The multi-screen collaboration module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
- 7.5 High severity
HarmonyOS: Improper Authentication
The DMSDP module of the distributed hardware has a vulnerability that may cause imposter control connections.Successful exploitation of this vulnerability may disconnect normal service connections.
- 7.5 High severity
HarmonyOS: Incorrect Default Permissions
The system has a vulnerability that may cause dynamic hiding and restoring of app icons.Successful exploitation of this vulnerability may cause malicious hiding of app icons.
- 9.8 Critical severity
HarmonyOS: Improper Privilege Management
Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause privilege escalation, which results in system service exceptions.
- 9.8 Critical severity
HarmonyOS: Out-of-bounds Write
Fingerprint calibration has a vulnerability of lacking boundary judgment. Successful exploitation of this vulnerability may cause out-of-bounds write.
- 9.8 Critical severity
HarmonyOS: Improper Authentication
A thread security vulnerability exists in the authentication process. Successful exploitation of this vulnerability may affect data integrity, confidentiality, and availability.
- 7.5 High severity
HarmonyOS: Improper Authorization
The application management module has a vulnerability in permission verification. Successful exploitation of this vulnerability causes unexpected clear of device applications.
- 7.5 High severity
HarmonyOS: Deserialization of Untrusted Data
The system tool has inconsistent serialization and deserialization. Successful exploitation of this vulnerability will cause unauthorized startup of components.
- 9.8 Critical severity
HarmonyOS: Deserialization of Untrusted Data
The system framework layer has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
- 7.5 High severity
HarmonyOS: Incorrect Default Permissions
The preset launcher module has a permission verification vulnerability. Successful exploitation of this vulnerability makes unauthorized apps add arbitrary widgets and shortcuts without interaction.
- 9.8 Critical severity
HarmonyOS: Deserialization of Untrusted Data
The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
- 9.8 Critical severity
HarmonyOS: Deserialization of Untrusted Data
The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
- 7.5 High severity
HarmonyOS: Incorrect Default Permissions
The SmartTrimProcessEvent module has a vulnerability of obtaining the read and write permissions on arbitrary system files. Successful exploitation of this vulnerability may affect data confidentiality.
- 7.5 High severity
HarmonyOS: Incorrect Default Permissions
The power module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause abnormal status of a module on the device.