Huawei HarmonyOS CVE-2025-58282

Exploitation requires local access to a HarmonyOS 5.0.1 or 5.1.0 device with at least low-level privileges already obtained - in practice, a malicious or compromised application running on the device that then abuses the camera module's permission-control flaw to reach camera data/services beyond its authorization. Limiting factors: the attacker cannot exploit this remotely or over a network (AV:L), must already hold some foothold/privilege on the device (PR:L), and gains only confidentiality disclosure with no integrity or availability impact (I:N/A:N) and no privilege scope expansion (S:U). The exact camera feature or configuration involved is not specified in the vendor description, so no non-default setting is known to be required.

This is a moderate-severity information-disclosure flaw (CVSS 5.5) in the HarmonyOS camera module, and the available signals consistently point to LOW real-world urgency rather than a top priority. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N shows exploitation requires LOCAL access (AV:L) and existing low privileges (PR:L) - i.e. an attacker must already be able to run code/an app on the device - and yields only confidentiality impact (C:H, I:N, A:N) with no scope change. EPSS is very low at 0.09% (0th percentile), the CVE is NOT on CISA KEV, and no public exploit code was identified, so all three exploitation signals agree: no evidence of active or imminent exploitation. There are no conflicting signals here - the local+low-privilege vector, negligible EPSS, and absence of KEV/POC align to indicate a bounded, locally-exploitable privacy issue most relevant in multi-app or malicious-app threat models rather than remote mass exploitation. The description is terse ('may affect service confidentiality') and provides no specific feature detail, which is the main data gap; vector-to-description consistency is reasonable (local permission-control flaw matches AV:L/PR:L).

A malicious or low-privileged application already installed on a HarmonyOS 5.0.1 or 5.1.0 device abuses a permission-control weakness in the camera module to access camera-related data or services it should not be authorized to reach, disclosing confidential information to the attacker-controlled app. No user interaction is required (UI:N), but the attacker must already have local low-privilege execution on the device. No public proof-of-concept exploit was identified at time of analysis.