EUVD-2025-17085Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents CRITICAL real-world risk based on multiple signal convergence: (1) CVSS 8.8 with high impact across all three security properties (C:H/I:H/A:H) demonstrates complete system compromise potential; (2) AV:A restricts to local network/adjacent segments, reducing internet-exposed risk but creating significant LAN/VLAN compromise scenarios; (3) AC:L and PR:N indicate near-trivial exploitation requiring minimal attacker sophistication; (4) CWE-290 classification suggests this is not a zero-day requiring advanced exploit development but rather a fundamental authentication flaw likely exploitable with standard network tools; (5) The availability impact noted in the description alongside confidentiality/integrity gains suggests DoS combined with data exfiltration and system manipulation capabilities. Without EPSS score or KEV status data provided, assume high probability based on CWE-290 prevalence and AV:A applicability to enterprise networks, VLANs, and IoT deployments. Organizations with DSoftBus on internal networks face immediate compromise risk if exploitable without authentication. |
| Exploit ScenarioDerived | An attacker on a corporate network or adjacent VLAN (satisfying AV:A requirement) sends crafted DSoftBus service discovery or RPC requests to a target device running vulnerable DSoftBus. Due to the authentication bypass flaw (CWE-290), the requests are processed without credential validation. The attacker can then: (1) invoke privileged DSoftBus services to execute arbitrary code or commands (availability/integrity impact); (2) exfiltrate sensitive data through service interfaces (confidentiality impact); (3) manipulate system configuration or crash services (availability impact). Because AC:L, no specialized POC development is required—standard protocol fuzzing or replay tools likely suffice. Example: internal network attacker floods DSoftBus with unauthenticated service calls, crashing critical device services and enabling lateral movement. If POC exists in the wild (KEV status would confirm), exploitation barrier is negligible for network-adjacent threats. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
CVE-2025-48906 is an authentication bypass vulnerability in the DSoftBus module that allows unauthenticated attackers on the local network to completely compromise system confidentiality, integrity, and availability without user interaction. The vulnerability affects DSoftBus implementations across multiple platforms with a CVSS score of 8.8, indicating critical severity with high exploitability potential on adjacent networks.
RemediationAI
Immediate actions: (1) Isolate DSoftBus-enabled devices from untrusted network segments; implement strict network segmentation and firewall rules limiting DSoftBus traffic to authorized hosts only; (2) Monitor for vendor security advisories from OpenHarmony, Huawei, and device manufacturers for patched versions; (3) Patch to latest DSoftBus versions once vendors release security updates addressing CWE-290 (expected to implement cryptographically sound authentication, mutual authentication, or capability-based authorization); (4) Temporary workarounds include disabling DSoftBus if not essential, restricting network access via iptables/firewall rules to trusted peers, or implementing application-level authentication overlays. Vendor patch links and specific version updates must be obtained from official OpenHarmony security advisories and device manufacturer security bulletins.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DSoftBus is a distributed soft bus communication module used for inter-process communication and service discovery in various operating systems and IoT platforms. The vulnerability root cause is classified under CWE-290 (Authentication Using a Broken or Risky Cryptographic Algorithm), indicating the authentication mechanism either uses insufficient cryptographic protections, lacks proper validation, or can be circumvented through cryptographic weaknesses. The adjacent network attack vector (AV:A) suggests the flaw exists in network-based authentication handshakes or credential validation during service discovery or RPC mechanisms within DSoftBus. The low attack complexity (AC:L) and no privilege requirement (PR:N) indicate this is a fundamental design flaw rather than edge-case exploitation requiring specific conditions.
Know when Harmonyos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Authentication bypass vulnerability in the DSoftBus module Impact: Successful exploitation of this vulnerability may affect availability.
Executive ViewAI
An authentication bypass vulnerability in the DSoftBus module poses a HIGH risk to system availability with a CVSS score of 8.8. Unauthenticated attackers could exploit this flaw to disrupt critical services, potentially affecting business operations and user access. Immediate action is required as no vendor patch is currently available.
Implement network segmentation to restrict DSoftBus access to authorized networks only; deploy WAF rules targeting authentication bypass patterns; enable enhanced logging and real-time alerting on DSoftBus authentication failures; consider disabling DSoftBus module if operationally feasible; implement rate limiting on authentication endpoints; maintain offline backups of critical data; establish incident response procedures for availability disruption.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Out-of-bounds heap write in Huawei HarmonyOS WEB module allows unauthenticated remote attackers to execute arbitrary cod
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
GitHub PoC
Exploit-DB