What is the CVSS score of CVE-2025-48909?

CVE-2025-48909 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Harmonyos are affected by CVE-2025-48909?

CVE-2025-48909 is a HIGH severity vulnerability affecting device management channels that could allow attackers to bypass security controls and access sensitive information.

How to fix or mitigate CVE-2025-48909?

Within 24 hours: Identify all systems running affected device management software and isolate them from untrusted networks if possible; alert security operations to monitor for exploitation attempts. Within 7 days: Implement network segmentation to restrict access to device management channels from known administrative IP ranges only; document all current device management access points and users. Within 30 days: Establish a vendor communication plan for patch availability; evaluate alternative device management solutions; conduct a security audit of device management channel configurations.

Harmonyos CVE-2025-48909

EUVD-2025-17066 HIGH

Improper Authentication (CWE-287)

2025-06-06 psirt@huawei.com

Authentication Bypass Information Disclosure Harmonyos

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17066

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 07:15 nvd

HIGH 7.1

DescriptionCVE.org

Bypass vulnerability in the device management channel Impact: Successful exploitation of this vulnerability may affect service confidentiality.

AnalysisAI

Bypass vulnerability in device management channels that allows unauthenticated attackers on adjacent networks to compromise service confidentiality and cause minor availability impact. The vulnerability affects device management implementations across multiple vendors (specific products require vendor advisories to identify). While no active exploitation in the wild has been confirmed in public KEV databases at time of analysis, the 7.1 CVSS score and high confidentiality impact warrant immediate attention for organizations managing devices on trusted networks.

Technical ContextAI

This vulnerability exploits improper authentication mechanisms (CWE-287: Improper Authentication) in device management channels—likely referring to protocols such as UPnP, DHCP, SNMP, or proprietary device provisioning interfaces. The attack vector being 'Adjacent Network' (AV:A) indicates the attacker must be on the same local network segment, broadcast domain, or have layer-2 access. The root cause is insufficient or missing authentication validation when processing management commands, allowing an unauthenticated actor to bypass access controls. CWE-287 encompasses missing or weak credential verification, potentially including: missing authentication checks before processing sensitive operations, reliance on implicit trust in local network contexts without explicit verification, or failure to validate management protocol messages. The 'No User Interaction' requirement (UI:N) and 'No Privileges Required' (PR:N) indicate the attack requires no social engineering or prior compromise—direct exploitation is possible.

RemediationAI

Without vendor-specific patch information in the provided data: 1) Immediate Workarounds: Isolate device management traffic on dedicated management VLANs; implement strict firewall rules limiting management channel access to authorized administrator subnets only; disable remote management features if not required; monitor device management protocols (UPnP, DHCP, proprietary channels) for unauthorized access attempts. 2) Patch Strategy: Monitor vendor security pages for CVE-2025-48909 patches; establish a testing/deployment timeline for management plane updates separate from production services to minimize downtime; prioritize devices with sensitive data or control functions. 3) Detection: Deploy network IDS/IPS signatures for unauthenticated device management requests; enable authentication logging and alerts on management interfaces; monitor for lateral movement from untrusted network segments toward management channels. 4) Long-term: Implement zero-trust network access for device management; require multi-factor authentication for management interfaces; encrypt management traffic (TLS/DTLS); conduct protocol-level security review of custom management implementations.