Huawei HarmonyOS CVE-2025-58301
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privileged access on device
-
ExploitSend malformed input to device management module
-
ExecutionTrigger stack buffer overflow (CWE-121)
-
ImpactCrash service or degrade availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a Huawei HarmonyOS 5.0.1 or 5.1.0 device and low-level privileges (PR:L) - for example, a running application context or limited local account able to reach the device management module; it cannot be triggered remotely over a network (AV:L). No user interaction is needed (UI:N). The impact is limited to availability (A:H only, with C:N/I:N), meaning the realistic outcome is a crash or denial of service of the affected component rather than code execution, data theft, or tampering. Limiting factors that reduce real-world risk: the mandatory local presence, the requirement for at least low privileges, and the absence of any confidentiality or integrity consequence. |
| Impact | This is a moderate-severity, low-priority issue in practice. The CVSS 3.1 base score of 5.5 reflects a local-only attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and an impact limited strictly to availability (C:N/I:N/A:H) with no scope change (S:U). All exploitation signals point away from urgency: EPSS is 0.09% (0th percentile), the CVE is not in CISA KEV, and no public proof-of-concept exists. The signals are internally consistent - a local, authenticated attacker can crash or degrade the device, but there is no remote reach and no confidentiality or integrity impact. There is no conflict between the CVSS vector and the description: both indicate local, privilege-dependent access affecting only availability. This is a genuinely lower-risk, denial-of-service-class flaw rather than a high-impact priority; it should be patched during routine maintenance unless the affected device plays an availability-critical role. |
| Exploit ScenarioDerived | A local, low-privileged attacker (e.g., a malicious or compromised app, or a user with limited shell access) on a HarmonyOS 5.0.1 or 5.1.0 device sends malformed input to the device management module, triggering a stack-based buffer overflow (CWE-121) that corrupts the stack and crashes the affected service or device. No public exploit code has been identified, and exploitation is confined to local access with no remote network path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
A stack-based buffer overflow (CWE-121) in the device management module of Huawei HarmonyOS 5.0.1 and 5.1.0 can be triggered by a local actor holding low-level privileges, resulting in a crash or denial of service of the affected component. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms the attack surface is local rather than remote, requires at least low privileges, needs no user interaction, and is limited to availability impact with no confidentiality or integrity consequence - a successful exploit cannot read data, alter data, or execute attacker-controlled code based on the assessed vector. Risk is low in practice: EPSS is only 0.09% (0th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
RemediationAI
Huawei has published a security bulletin covering this issue in its October 2025 consumer bulletin (https://consumer.huawei.com/en/support/bulletin/2025/10/), and the primary remediation is to apply the vendor-supplied update for HarmonyOS listed in that bulletin - no exact fixed build number is present in the supplied data, so confirm the patched version for each affected device model directly in the advisory before updating. Where updating immediately is not possible, the practical compensating controls follow directly from the assessed vector: because exploitation requires local presence and at least low-level privileges (AV:L/PR:L), restrict installation of untrusted or sideloaded applications, review and minimize granted permissions for applications that can reach device management functionality, and remove or suspend low-trust local accounts and services on managed fleets; enforcement of Huawei's app-signing and app-store-only installation policies materially shrinks the attack surface, though the trade-off is reduced flexibility for legitimate side-loaded tooling. Because impact is limited to availability (A:H only, C:N/I:N), there is no data-exfiltration or tampering exposure to mitigate, and the residual risk of an unpatched device is a component crash/denial of service rather than disclosure or code execution; at 0.09% EPSS with no KEV listing and no public exploit code identified, this can be scheduled within a routine patch cycle rather than treated as an emergency.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a stack-based buffer overflow (CWE-121) in the HarmonyOS device management module, a system component responsible for device configuration and management operations on the platform. The weakness class involves copying or writing more data into a fixed-size stack buffer than it can hold, corrupting adjacent stack memory such as saved registers or the return address; because the overwritten data is stack-resident, the typical failure mode is memory corruption leading to a process abort rather than a controlled write primitive. The assessed CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) places the vulnerability firmly in the local-attack, low-privilege, availability-only category: the attacker must already be executing on the device (for example from an application context or limited local account) and must be able to reach the device management interface, and the sole demonstrable impact is loss of availability - no scope change, no confidentiality or integrity impact. Affected builds are identified by CPE entries for huawei:harmonyos:5.0.1 and huawei:harmonyos:5.1.0, and the vendor's own PSIRT (psirt@huawei.com) is the reporting party, with tagging indicating both buffer overflow and stack overflow characteristics.
Know when Harmonyos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local-only device management flaw reachable by a low-privileged context (AV:L/PR:L), easily triggered (AC:L), affecting only availability via a crash (A:H, C:N/I:N).
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Buffer overflow vulnerability in the device management module. Successful exploitation of this vulnerability may affect availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Affected Products (CPE)NVD
Out-of-bounds heap write in Huawei HarmonyOS WEB module allows unauthenticated remote attackers to execute arbitrary cod
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
GitHub PoC
Exploit-DB