HarmonyOS CVE-2025-58284

Exploitation requires a local, already-authenticated low-privilege context on the device (PR:L, AV:L) - in practice a malicious or compromised application running on an affected HarmonyOS 5.0.1 or 5.1.0 device - that then abuses the network module's permission-control logic to access confidential data. Limiting factors: the attacker must already have code execution / app-level foothold on the device (no remote vector), there is no privilege elevation or data modification (I:N, A:N), and impact is confined to confidentiality disclosure; devices on patched builds from Huawei's October 2025 bulletin are not affected.

This is a genuinely moderate-to-low priority issue despite the 'Privilege Escalation' tag. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) is internally consistent and tells the real story: exploitation requires LOCAL access and EXISTING low-level privileges (PR:L) on the device, and the impact is confined to confidentiality (C:H) with no integrity or availability effect. This is not a remote or unauthenticated flaw. EPSS reinforces the low-urgency reading at 0.10% (1st percentile), indicating negligible modeled exploitation probability. There is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation. The only mild tension is the 'Privilege Escalation' tag combined with CWE-264 (permissions/privileges), versus the actual impact profile of confidentiality-only with no integrity change (I:N) - this behaves more like a permission-bypass information-disclosure issue than a classic privilege-escalation-to-higher-rights flaw; treat the 'Privilege Escalation' label with caution. The Huawei advisory reference is a generic monthly-bulletin landing page, not a CVE-specific writeup, so precise affected-build and fix details are not independently confirmed from the provided data.

A malicious or compromised low-privilege application already running on a HarmonyOS 5.0.1 or 5.1.0 device abuses a permission-control weakness in the network module to read data it should not be authorized to access, disclosing confidential information to the attacker. No remote access, user interaction, or elevated privileges are needed beyond the local foothold. No public proof-of-concept exploit has been identified at the time of analysis.