Huawei vulnerabilities
We track 270 vulnerabilities in Huawei products across 60+ products. 270 are rated high or critical, and 4 have been exploited in real attacks. The most recent was published on November 2, 2026.
Latest Huawei vulnerabilities
- 7.5 High severity
HarmonyOS: Authentication Bypass by Spoofing
Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
AR6000: Improper Neutralization of Special Elements used in an OS Command
A Huawei data communication product has a command injection vulnerability. Successful exploitation of this vulnerability may allow attackers to gain higher privileges.
- 7.1 High severity
AR6000: Improper Access Control
An improper access control vulnerability exists in a Huawei datacom product. Attackers can exploit this vulnerability to obtain partial device information.
- 8.8 High severity
AJMD-370S: Improper Authentication
The Bluetooth module of some Huawei Smart Screen products has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability may allow attackers to access restricted functions. Successful exploitation of this vulnerability may a
- 7.5 High severity
HarmonyOS: Missing Authorization
Vulnerability of missing permission verification for APIs in the Designed for Reliability (DFR) module. Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Improper Privilege Management
Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the device.
- 7.5 High severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
The remote PIN module has a vulnerability that causes incorrect information storage locations.Successful exploitation of this vulnerability may affect confidentiality.
- 7.5 High severity
EMUI: Out-of-bounds Write
Vulnerability of parameters being out of the value range in the QMI service module. Successful exploitation of this vulnerability may cause errors in reading file data.
- 7.5 High severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability of improper permission control in the Booster module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 9.1 Critical severity
HarmonyOS: Authentication Bypass by Spoofing
Vulnerability of identity verification being bypassed in the face unlock module. Successful exploitation of this vulnerability will affect integrity and confidentiality.
- 7.5 High severity
HarmonyOS: Out-of-bounds Write
Out-of-bounds vulnerability in the sensor module. Successful exploitation of this vulnerability may cause mistouch prevention errors on users' mobile phones.
- 9.1 Critical severity
HarmonyOS: Improper Access Control
Vulnerability of undefined permissions in the MeeTime module.Successful exploitation of this vulnerability will affect availability and confidentiality.
- 9.8 Critical severity
HarmonyOS: Missing Authentication for Critical Functionality
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this vulnerability may cause some apps to run without being authorized.
- 9.8 Critical severity
HarmonyOS: Improper Privilege Management
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5 High severity
HarmonyOS: Improper Restriction of Excessive Authentication Attempts
Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.
- 9.8 Critical severity
HarmonyOS: Improper Privilege Management
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5 High severity
HarmonyOS: Exposure of Resource to Wrong Sphere
The Bluetooth module has a vulnerability in permission control for broadcast notifications.Successful exploitation of this vulnerability may affect confidentiality.
- 7.5 High severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability of the permission to access device SNs being improperly managed.Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Improper Restriction of Excessive Authentication Attempts
Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability of package names' public keys not being verified in the security module.Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Inadequate Encryption Strength
Vulnerability of 5G messages being sent without being encrypted in a VPN environment in the SMS message module. Successful exploitation of this vulnerability may affect confidentiality.
- 7.5 High severity
HarmonyOS: NULL Pointer Dereference
Stability-related vulnerability in the binder background management and control module. Successful exploitation of this vulnerability may affect availability.
- 7.5 High severity
HarmonyOS: Improper Neutralization of Special Elements used in a Command
Command injection vulnerability in the distributed file system module. Successful exploitation of this vulnerability may cause variables in the sock structure to be modified.
- 7.5 High severity
HarmonyOS: Improper Limitation of a Pathname to a Restricted Directory
Redirection permission verification vulnerability in the home screen module. Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5 High severity
Vulnerability of parameters not being strictly verified in the PMS module.
Vulnerability of parameters not being strictly verified in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.
- 9.8 Critical severity
Input verification vulnerability in the fingerprint module.
Input verification vulnerability in the fingerprint module. Successful exploitation of this vulnerability will affect confidentiality, integrity, and availability.
- 7.5 High severity
Vulnerability of input parameter verification in certain APIs in the window management module.
Vulnerability of input parameter verification in certain APIs in the window management module. Successful exploitation of this vulnerability may cause the device to restart.
- 9.1 Critical severity
HarmonyOS: Improperly Implemented Security Check for Standard
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
- 9.1 Critical severity
HarmonyOS: Improper Limitation of a Pathname to a Restricted Directory
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
- 9.1 Critical severity
HarmonyOS: Improper Limitation of a Pathname to a Restricted Directory
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
- 9.1 Critical severity
HarmonyOS: Improper Limitation of a Pathname to a Restricted Directory
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
- 9.1 Critical severity
Parameter verification vulnerability in the installd module.
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
- 9.1 Critical severity
Parameter verification vulnerability in the installd module.
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
- 7.5 High severity
Mismatch vulnerability in the serialization process in the communication system.
Mismatch vulnerability in the serialization process in the communication system. Successful exploitation of this vulnerability may affect availability.
- 7.5 High severity
Vulnerability of API privilege escalation in the wifienhance module.
Vulnerability of API privilege escalation in the wifienhance module. Successful exploitation of this vulnerability may cause the arp list to be modified.
- 7.5 High severity
Vulnerability of input parameter verification in certain APIs in the window management module.
Vulnerability of input parameter verification in certain APIs in the window management module. Successful exploitation of this vulnerability may cause the device to restart.
- 7.5 High severity
Vulnerability of input parameters being not strictly verified in the PMS module.
Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause newly installed apps to fail to restart.
- 9.1 Critical severity
Vulnerability of configuration defects in the media module of certain products..
Vulnerability of configuration defects in the media module of certain products.. Successful exploitation of this vulnerability may cause unauthorized access.
- 9.8 Critical severity
HarmonyOS: Out-of-bounds Write
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Successful exploitation of this vulnerability may cause other apps to be executed with escalated privileges.
- 7.5 High severity
HarmonyOS: Improper Verification of Cryptographic Signature
Vulnerability of insecure signatures in the ServiceWifiResources module. Successful exploitation of this vulnerability may cause ServiceWifiResources to be maliciously modified and overwritten.