Honor Devices CVE-2025-57838

Exploitation requires local access to an affected Honor device (CVSS AV:L), typically meaning the attacker must already be able to run code on the device - for example via a malicious installed application or an already-compromised process - rather than attacking remotely over the network. No privileges (PR:N) or user interaction (UI:N) are required once local access exists, and complexity is low (AC:L). The impact is limited to confidentiality (C:L) with no integrity or availability effect. The primary limiting factors are the local attack vector (no remote exploitation) and the vague, unspecified product scope; the source description does not name the specific product, configuration, feature, or type of data exposed, so defenders should confirm which Honor products and versions are affected via the vendor advisory.

This is a low-priority, low-real-risk issue despite being a validly tracked CVE. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) yields a base score of 4.0 (Medium) and is internally consistent: a local attack vector with no privileges or user interaction, producing only limited confidentiality impact and no integrity or availability impact - fitting the CWE-200 information-exposure classification. The real-world exploitation signals reinforce the low priority: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code was identified. All signals align in the low-risk direction - there is no conflict between a high CVSS and low EPSS here because the CVSS itself is only Medium. The one notable limitation is the extreme vagueness of the source description ('Some Honor products are affected by information leak vulnerability'), which names no specific product, version, feature, or data exposed; the AV:L designation indicates local rather than remote exploitation, so an attacker generally needs prior code execution or physical/app-level access to the device. Verify affected product scope and the nature of the leaked data directly with the Honor advisory before deprioritizing in any specific deployment.

A malicious or compromised local application (or an attacker with existing on-device access) running on an affected Honor product abuses the vulnerable component to read information it should not be able to access, disclosing limited confidential data. Because the CVSS vector is local (AV:L) with low complexity and no required privileges or user interaction, exploitation is straightforward once code is already running on the device, but it does not enable remote compromise. No public proof-of-concept exploit code was identified at the time of analysis.