Huawei vulnerabilities
We track 270 vulnerabilities in Huawei products across 60+ products. 270 are rated high or critical, and 4 have been exploited in real attacks. The most recent was published on November 2, 2026.
Latest Huawei vulnerabilities
- 9.8 Critical severity
HarmonyOS AILife Solution 6.0: Improper Privilege Management
A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnerability could allow attackers to access restricted functions.
- 9.8 Critical severity
HarmonyOS AILife Solution 6.0: Improper Privilege Management
A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnerability could allow attackers to access restricted functions.
- 7.5 High severity
BiSheng-WNM: Interpretation Conflict
There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation of this vulnerability may cause the printer service to be abnormal.
- 9.8 Critical severity
BiSheng-WNM: Improper Neutralization of Special Elements used in a Command
There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could allow attackers to gain higher privileges.
- 9.8 Critical severity
BiSheng-WNM: Improper Neutralization of Special Elements used in a Command
There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. A Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code execution.
- 7.5 High severity
HarmonyOS: Missing Authorization
The AMS module has a vulnerability of lacking permission verification in APIs.Successful exploitation of this vulnerability may affect data confidentiality.
- 7.5 High severity
HarmonyOS: Improper Preservation of Permissions
The bundle management module lacks permission verification in some APIs. Successful exploitation of this vulnerability may restore the pre-installed apps that have been uninstalled.
- 7.5 High severity
HarmonyOS: Improper Validation of Specified Quantity in Input
The geofencing kernel code does not verify the length of the input data. Successful exploitation of this vulnerability may cause out-of-bounds memory access.
- 7.5 High severity
HarmonyOS: Improper Validation of Specified Quantity in Input
The geofencing kernel code has a vulnerability of not verifying the length of the input data. Successful exploitation of this vulnerability may cause out-of-bounds memory access.
- 7.5 High severity
HarmonyOS: Improper Preservation of Permissions
The IHwAntiMalPlugin interface lacks permission verification. Successful exploitation of this vulnerability can lead to filling problems (batch installation of applications).
- 9.1 Critical severity
HarmonyOS: Protection Mechanism Failure
The phone-PC collaboration module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data confidentiality and integrity.
- 7.5 High severity
HarmonyOS: Missing Authentication for Critical Functionality
The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affect data confidentiality.
- 7.5 High severity
HarmonyOS: Missing Authentication for Critical Functionality
The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affect data confidentiality.
- 7.5 High severity
HarmonyOS: Improper Privilege Management
The multi-screen collaboration module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
- 7.5 High severity
HarmonyOS: Improper Authentication
The DMSDP module of the distributed hardware has a vulnerability that may cause imposter control connections.Successful exploitation of this vulnerability may disconnect normal service connections.
- 7.5 High severity
HarmonyOS: Incorrect Default Permissions
The system has a vulnerability that may cause dynamic hiding and restoring of app icons.Successful exploitation of this vulnerability may cause malicious hiding of app icons.
- 7.8 High severity
Aslan-AL10: Improper Limitation of a Pathname to a Restricted Directory
Huawei Aslan Children's Watch has a path traversal vulnerability. Successful exploitation may allow attackers to access or modify protected system resources.
- 7.5 High severity
Huawei Aslan Children's Watch has an improper input validation vulnerability.
Huawei Aslan Children's Watch has an improper input validation vulnerability. Successful exploitation may cause the watch's application service abnormal.
- 9.8 Critical severity
HarmonyOS: Improper Privilege Management
Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause privilege escalation, which results in system service exceptions.
- 9.8 Critical severity
HarmonyOS: Out-of-bounds Write
Fingerprint calibration has a vulnerability of lacking boundary judgment. Successful exploitation of this vulnerability may cause out-of-bounds write.
- 9.8 Critical severity
HarmonyOS: Improper Authentication
A thread security vulnerability exists in the authentication process. Successful exploitation of this vulnerability may affect data integrity, confidentiality, and availability.
- 7.5 High severity
HarmonyOS: Improper Authorization
The application management module has a vulnerability in permission verification. Successful exploitation of this vulnerability causes unexpected clear of device applications.
- 7.5 High severity
HarmonyOS: Deserialization of Untrusted Data
The system tool has inconsistent serialization and deserialization. Successful exploitation of this vulnerability will cause unauthorized startup of components.
- 9.8 Critical severity
HarmonyOS: Deserialization of Untrusted Data
The system framework layer has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
- 7.5 High severity
HarmonyOS: Incorrect Default Permissions
The preset launcher module has a permission verification vulnerability. Successful exploitation of this vulnerability makes unauthorized apps add arbitrary widgets and shortcuts without interaction.
- 9.8 Critical severity
HarmonyOS: Deserialization of Untrusted Data
The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
- 9.8 Critical severity
HarmonyOS: Deserialization of Untrusted Data
The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
- 7.5 High severity
HarmonyOS: Incorrect Default Permissions
The SmartTrimProcessEvent module has a vulnerability of obtaining the read and write permissions on arbitrary system files. Successful exploitation of this vulnerability may affect data confidentiality.
- 7.5 High severity
HarmonyOS: Incorrect Default Permissions
The power module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause abnormal status of a module on the device.
- 9.8 Critical severity
HarmonyOS: Concurrent Execution using Shared Resource with Improper Synchronization
The iaware module has a vulnerability in thread security. Successful exploitation of this vulnerability will affect confidentiality, integrity, and availability.
- 7.5 High severity
HarmonyOS: Use After Free
The graphics display module has a UAF vulnerability when traversing graphic layers. Successful exploitation of this vulnerability may affect system availability.
- 7.5 High severity
HarmonyOS: Missing Authorization
The LBS module has a vulnerability in geofencing API access. Successful exploitation of this vulnerability may cause third-party apps to access the geofencing APIs without authorization, affecting user confidentiality.
- 7.5 High severity
HarmonyOS: Incomplete Cleanup
The kernel module has the vulnerability that the mapping is not cleared after the memory is automatically released. Successful exploitation of this vulnerability may cause a system restart.
- 7.5 High severity
HarmonyOS: Improper Check or Handling of Exceptional Conditions
The DFX unwind stack module of the ArkCompiler has a vulnerability in interface calling.Successful exploitation of this vulnerability affects system services and device availability.
- 7.5 High severity
HarmonyOS: Improper Handling of Length Parameter Inconsistency
The communication framework module has a vulnerability of not truncating data properly.Successful exploitation of this vulnerability may affect data confidentiality.
- 7.5 High severity
HarmonyOS: Out-of-bounds Read
The storage maintenance and debugging module has an array out-of-bounds read vulnerability.Successful exploitation of this vulnerability will cause incorrect statistics of this module.
- 9.1 Critical severity
HarmonyOS: Out-of-bounds Read
The HW_KEYMASTER module has a vulnerability of not verifying the data read.Successful exploitation of this vulnerability may cause malicious construction of data, which results in out-of-bounds access.
- 9.8 Critical severity
HarmonyOS: Out-of-bounds Read
The HW_KEYMASTER module has a vulnerability of not verifying the data read.Successful exploitation of this vulnerability may cause malicious construction of data, which results in out-of-bounds access.
- 9.8 Critical severity
HarmonyOS: Out-of-bounds Write
The MPTCP module has an out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause root privilege escalation attacks implemented by modifying program information.
- 7.1 High severity
HarmonyOS: Out-of-bounds Read
The kernel server has a vulnerability of not verifying the length of the data transferred in the user space.Successful exploitation of this vulnerability may cause out-of-bounds read in the kernel, which affects the device confidentiality and availability.