Huawei Camera CVE-2025-58277

Exploitation requires local access to the device (AV:L) and mandatory user interaction (UI:R) - in practice, the victim installing and/or running a malicious or malfunctioning application that abuses the Camera app's permission-verification bypass. No pre-existing privileges are needed (PR:N). Impact is limited to confidentiality disclosure (C:H, I:N, A:N) affecting only HarmonyOS 5.0.1 and 5.1.0; the requirement for local presence and user action, combined with no remote vector, substantially limits realistic exploitation. The precise feature or configuration state of the Camera app that triggers the bypass is not specified in the available description.

This is a moderate-severity, low-priority issue rather than an urgent one. The CVSS 3.1 base score of 5.5 is driven by a local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N) but mandatory user interaction (UI:R), unchanged scope, and a high confidentiality impact with no integrity or availability impact (C:H/I:N/A:N) - consistent with CWE-200 information disclosure via a permission-verification bypass in the Camera app. All exploitation signals point the same direction, low: EPSS is 0.09% (0th percentile), there is no CISA KEV listing, and no public exploit code was identified. The confidentiality-only, local, interaction-dependent profile makes widespread or automated exploitation implausible; the realistic concern is a malicious or privacy-abusing app on-device bypassing camera permission checks to read data it should not. No SSVC decision data was provided in the input. No signals conflict here - CVSS severity (medium) and real-world exploitation likelihood (very low) are aligned, so this belongs in routine patch cycles rather than emergency remediation.

A user is convinced to install a malicious or over-reaching application on a HarmonyOS 5.0.1/5.1.0 device. The app exploits the Camera app's flawed permission verification to access camera-related data or functionality without holding the proper permission, disclosing confidential information. No public exploit code is known, and the attack requires local presence plus the user action of running the app (UI:R).