What is the CVSS score of CVE-2025-48911?

CVE-2025-48911 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Harmonyos are affected by CVE-2025-48911?

CVE-2025-48911 is a HIGH severity vulnerability in our note sharing module that could allow unauthorized users to access or disrupt shared notes, potentially impacting business continuity and data…

How to fix or mitigate CVE-2025-48911?

Within 24 hours: Inventory all systems using the note sharing module and assess exposure scope; establish monitoring for exploitation attempts. Within 7 days: Implement compensating controls (disable note sharing if non-critical, restrict access via network segmentation, or apply WAF rules to limit sharing endpoints). Within 30 days: Establish vendor contact for patch timeline; conduct full security audit of the sharing module; prepare rollout plan for patching once available.

Harmonyos CVE-2025-48911

EUVD-2025-17064 HIGH

Incorrect Privilege Assignment (CWE-266)

2025-06-06 psirt@huawei.com

Information Disclosure Privilege Escalation Harmonyos

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17064

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 07:15 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability of improper permission assignment in the note sharing module Impact: Successful exploitation of this vulnerability may affect availability.

AnalysisAI

CVE-2025-48911 is an improper permission assignment vulnerability in a note sharing module that allows local attackers with user interaction to compromise system availability and potentially access sensitive information. The vulnerability has a CVSS score of 8.2 (High) with a broad scope impact, though specific affected products, patch status, and exploitation telemetry are not provided in the available intelligence sources. Without KEV confirmation or EPSS data, the real-world exploitation risk cannot be definitively assessed, but the local attack vector and user interaction requirement suggest this is less critical than remote, unauthenticated vulnerabilities.

Technical ContextAI

This vulnerability stems from CWE-266 (Improper Privilege Assignment), a weakness where access control mechanisms fail to correctly enforce permission boundaries in the note sharing functionality. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:C) indicates a local attack surface requiring no privileges but needing user interaction, with cross-scope impact suggesting the vulnerability can affect resources beyond the immediate application context. The note sharing module likely implements collaborative features (read, write, delete, share permissions) without proper validation of user roles or access control lists, allowing a local attacker to escalate or modify permissions through social engineering or UI-based manipulation. No specific CPE strings, vendor identification, or product versions are available from the provided data, limiting the ability to identify exact affected deployments.

RemediationAI

No specific patch versions, vendor advisories, or remediation guidance are provided in the available intelligence. Recommended actions: (1) Contact the affected software vendor directly to obtain patch information and timelines; (2) Check the vendor's security advisory portal for CVE-2025-48911-specific guidance; (3) If patches are available, prioritize deployment in line with internal patch management SLAs (recommend within 30 days given CVSS 8.2); (4) Interim mitigations pending patch deployment—restrict local access to systems running the affected software, review and audit current permission assignments in note-sharing features, disable note-sharing functionality if not operationally critical; (5) Implement access controls to limit user interaction triggers that could activate the vulnerability (e.g., restrict permission modification UI access to administrators); (6) Monitor logs for unauthorized permission changes or access pattern anomalies.