Huawei HarmonyOS
CVE-2025-58300
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privilege local code execution on device
-
ExploitSend malformed input to device management module
-
ExecutionTrigger stack buffer overflow (CWE-121)
-
ImpactCrash service and deny availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have local, low-privileged access to an affected HarmonyOS device (5.0.1 or 5.1.0) and the ability to deliver crafted input to the device management module - there is no remote or network-reachable path (AV:L) and no path to code execution or data disclosure, only a crash. Limiting factors: the attacker must already hold valid low-level privileges on the device (PR:L, authenticated), no user interaction is involved, and the impact is confined to availability (device/service denial of service) with no confidentiality or integrity effect, substantially narrowing realistic risk relative to the raw score. |
| Impact | This is a genuine but low-priority issue, not a high-CVSS scare. The CVSS 3.1 base score is 5.5 (medium), and the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H is internally consistent and well-aligned with the description: a stack-based buffer overflow (CWE-121) in the HarmonyOS device management module whose only consequence is loss of availability (A:H), with no confidentiality or integrity impact. All exploitation signals agree that real-world risk is limited: the attack vector is local (AV:L) and requires existing low privileges (PR:L), the EPSS score is 0.09% (0th percentile) indicating essentially no observed exploitation activity, the CVE is NOT in the CISA KEV catalog, and no public exploit code was identified. There is no conflict among the signals - a local, authenticated, availability-only flaw with near-zero EPSS and no KEV/POC is a defense-in-depth patch rather than an emergency. The only data limitation is that Huawei's advisory is a bulletin index URL rather than a CVE-specific writeup, so exact affected build details and the precise triggering interface within the device management module are not independently confirmed. |
| Exploit ScenarioDerived | A low-privileged local app or user on an affected HarmonyOS 5.0.1 or 5.1.0 device sends malformed input to the device management module, overflowing a stack buffer and crashing the service or device. No public exploit code is available, and because the vector is local and authenticated, the attacker must already be running code on the device, limiting impact to denial of service rather than remote compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Local low-privileged attackers can crash Huawei HarmonyOS 5.0.1 and 5.1.0 by triggering a stack-based buffer overflow (CWE-121) in the device management module, causing availability loss; the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates authenticated local access is required, with no confidentiality or integrity impact and no code execution path identified. The EPSS score is 0.09% (percentile 0%), and no public exploit code was identified at time of analysis; this is a genuine but low-priority issue, not a high-CVSS scare.
RemediationAI
Apply the latest Huawei-provided HarmonyOS security update referenced in the vendor bulletin at https://consumer.huawei.com/en/support/bulletin/2025/10/; the exact patched version is not specified in the provided intelligence, so confirm the fixed build in the advisory before deployment. Because exploitation requires authenticated local low-privileged access, prioritize restricting local accounts and apps that can interact with the device management module, and consider disabling or tightly controlling developer/debug interfaces such as ADB where operationally feasible, with the trade-off of reduced diagnostic capability. Monitor for repeated crashes or availability loss in the device management service as a detection signal, and note that network/perimeter controls are not the primary mitigation because the vector is local (AV:L) rather than remote.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a stack-based buffer overflow in the device management module of Huawei HarmonyOS. CWE-121 denotes improper bounds checking when copying input into a stack buffer, so crafted local input can overwrite adjacent stack memory and crash the affected service or device, yielding only denial of service. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms that the attacker must already have low-privileged local access to the device; there is no remote or network-reachable path, no user interaction, no scope change, and impact is confined to availability. The affected CPEs are HarmonyOS 5.0.1 and 5.1.0. EPSS is very low at 0.09%, and no KEV or POC signal is present in the provided data.
Know when Harmonyos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local module reachable only on-device gives AV:L; it needs existing low privileges (PR:L); a stack overflow yielding only a crash maps to C:N/I:N/A:H.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Buffer overflow vulnerability in the device management module. Successful exploitation of this vulnerability may affect availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Affected Products (CPE)NVD
Out-of-bounds heap write in Huawei HarmonyOS WEB module allows unauthenticated remote attackers to execute arbitrary cod
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
GitHub PoC
Exploit-DB