Huawei HarmonyOS CVE-2025-58285

Exploitation requires local code execution on the device at a low-privilege level (PR:L) - in practice a malicious or compromised application already installed and running on HarmonyOS 5.0.1 or 5.1.0 - that then interacts with the media module and abuses its permission control to access confidential data. It is NOT remotely exploitable (AV:L), requires no user interaction (UI:N), and is limited to affecting confidentiality only (I:N/A:N). Key limiting factors: the attacker must first obtain an on-device foothold/app installation, and only the two listed HarmonyOS versions are confirmed affected, which substantially narrows realistic exposure despite the OS's large install base.

This is a genuine but low-to-moderate priority issue, not a top-tier emergency. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5 Medium) describes a locally-exploitable flaw requiring an already-present low-privileged context (e.g. an installed app), no user interaction, and yielding high confidentiality impact only - no integrity or availability loss and no scope change. EPSS is 0.09% (0th percentile), indicating essentially no observed exploitation activity in the wild, consistent with the local-only attack surface. The CVE is NOT in CISA KEV and no public POC is referenced, so there is no public exploit identified at time of analysis. Note a labeling tension: the vendor tag is 'Privilege Escalation,' yet the vector shows C:H with I:N/A:N, meaning the real outcome is information disclosure (a permission/access-control bypass exposing confidential data) rather than a gain of execution privileges - treat this as a confidentiality-bypass, not a full privilege escalation. The requirement for local access plus pre-existing low privileges, combined with near-zero EPSS and no KEV/POC, makes widespread opportunistic exploitation unlikely; realistic risk is scoped to a malicious or compromised app already running on the device.

A malicious application installed on a HarmonyOS device (or malware that has gained a low-privilege foothold) invokes the media module and abuses weak permission/access controls to read confidential data it should not be authorized to access. Because the vector is local with no user interaction, exploitation happens silently within the app's own execution once it is on the device. No public exploit code is referenced at time of analysis.