Huawei HarmonyOS
CVE-2025-58292
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege local foothold on device
-
ExploitSend crafted path-traversal input to office service
-
ImpactCrash service and deny availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path traversal prevention
|
| Exploitation Conditions | Exploitation requires LOCAL access to a Huawei HarmonyOS 5.0.1 or 5.1.0 device with LOW privileges already held (PR:L), and no user interaction (UI:N). The specific trigger is a relative path-traversal condition (CWE-27) in the device's 'office service', where attacker-controlled path input causes the service to fail. Limiting factors that reduce real-world risk: there is no remote vector (AV:L is local-only), the attacker must already have an authenticated low-privilege context on the device, the impact is confined to availability (C:N/I:N) with no data exposure or code execution, and only the two named HarmonyOS versions are listed as affected. |
| Impact | This is a moderate-severity, low-priority issue when all signals are weighed together. The CVSS 3.1 base score is 5.5 (medium) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, meaning exploitation requires LOCAL access and LOW existing privileges, produces no confidentiality or integrity loss, and only degrades availability - consistent with a denial-of-service against the HarmonyOS 'office service'. The CWE-27 classification (relative path traversal) combined with CWE's DoS-only impact suggests a crafted path crashes or hangs the service rather than enabling code execution. The EPSS score is very low at 0.11% (1st percentile), indicating negligible predicted exploitation activity. There is NO CISA KEV listing and NO public exploit referenced, so this is not confirmed exploited. The signals are internally consistent - low EPSS, local-only vector, privileged prerequisite, and availability-only impact all point the same direction, with no conflict to resolve. No SSVC decision data was provided in the input. Net assessment: a genuine but low-urgency defect best handled via routine patching rather than emergency response. |
| Exploit ScenarioDerived | A low-privileged application or user already present on a Huawei HarmonyOS 5.0.1 or 5.1.0 device supplies a maliciously crafted relative path (CWE-27) to the office service, causing it to crash or become unresponsive and denying that service to the device. No remote vector, user interaction, or elevated privileges are needed beyond the attacker's existing local low-privilege foothold. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Denial of service in Huawei HarmonyOS 5.0.1 and 5.1.0 allows a locally-present, low-privileged application to crash the device's 'office service' by supplying crafted path input that triggers a relative path-traversal condition, degrading availability of the affected service. The attack is local-only (AV:L) and requires the attacker to already hold a low-privilege authenticated context on the device (PR:L), with no user interaction needed (UI:N); there is no confidentiality or integrity impact and no code execution. Risk to most environments is limited: no public exploit identified at time of analysis, EPSS is 0.11% (1st percentile), and the issue is not listed in CISA KEV.
RemediationAI
Apply the fixed HarmonyOS build for the 5.0.1 and 5.1.0 branches as published in Huawei's October 2025 consumer security bulletin (https://consumer.huawei.com/en/support/bulletin/2025/10/), which is the authoritative source for the exact patched version; note that the available data does not include an explicit fixed version string, so the advisory must be checked rather than assuming a build number. If immediate update of all devices is not feasible, compensate by restricting installation or privilege grants for untrusted third-party apps, since exploitation requires a locally-installed low-privilege app context - this reduces the attack surface but does not eliminate the flaw for already-installed apps. Additional interim controls include limiting which applications are permitted to interact with the office service or open untrusted office documents on managed devices, and monitoring device crash/ANR telemetry for repeated office-service failures as an indicator of attempted triggering; the trade-off is reduced functionality and user friction for legitimate office workflows. Rebooting or restarting the office service restores availability after a successful denial-of-service, but does not prevent re-triggering, so patching remains the only complete fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in the office service shipped on Huawei HarmonyOS, the vendor's HarmonyOS/OpenHarmony-derived mobile operating system. The root-cause class is CWE-27, 'Path Traversal: dir/../../filename' - a form of relative path traversal in which a path string is built by concatenating or resolving attacker-influenced input that contains relative '..' segments, causing the service to resolve a path outside its intended directory and then fail when the resulting resource cannot be handled. Because the observed consequence is a service failure rather than disclosure or modification of files, the CVSS impact vector is C:N/I:N/A:H with S:U, i.e. a pure availability defect scoped to the vulnerable component. The CVSS vector (AV:L/AC:L/PR:L/UI:N) means the trigger is reachable only from a local execution context on the device - typically a third-party or pre-installed app sandbox - with no network vector and no user prompt. CPE data pins the affected platform builds to cpe:2.3:o:huawei:harmonyos:5.0.1 and cpe:2.3:o:huawei:harmonyos:5.1.0, so the exposure is bounded to those two named OS versions rather than the HarmonyOS family as a whole.
Know when Harmonyos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local DoS requiring an existing low-privilege foothold gives AV:L/PR:L/AC:L; only service availability is affected, so C:N/I:N/A:H with unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
Out-of-bounds heap write in Huawei HarmonyOS WEB module allows unauthenticated remote attackers to execute arbitrary cod
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
GitHub PoC
Exploit-DB