Huawei HarmonyOS CVE-2025-58309

Exploitation requires local access to a Huawei device running an affected HarmonyOS version (5.0.1, 5.1.0, or 6.0.0) and the attacker must already hold low-level privileges (PR:L) - typically a locally installed/running application or local account - to reach the startup recovery module. No user interaction is needed (UI:N), but remote exploitation is not possible (AV:L), which is the primary limiting factor: an attacker cannot trigger this over a network and must first obtain code execution or an account on the device. The flaw stems from inadequate permission/access control in the startup recovery module itself, so devices patched per the Huawei November 2025 bulletin are not affected.

This is a genuinely moderate-priority local issue rather than a widespread remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local attacker who already holds some low-level privilege (e.g., an installed/sandboxed app or local account) exploiting a permission-control flaw in the startup recovery module, yielding high confidentiality and high availability impact but no integrity impact (C:H/I:N/A:H), consistent with the stated 7.1 score. The EPSS probability is effectively negligible at 0.01% (1st percentile), and there is no CISA KEV listing and no public POC, so no public exploit identified at time of analysis. These signals are internally consistent - a local-access, authenticated bug on a mobile OS with no known exploitation - so there is no conflict to resolve. The 'Privilege Escalation' tag aligns with the local, low-privilege nature, though note the CVSS records no integrity impact, which is somewhat atypical for classic privilege escalation; treat the escalation framing as approximate. No SSVC decision data was provided in the input, so automatable/technical-impact classification cannot be stated. Overall: prioritize as part of routine HarmonyOS patch cycles, not as an emergency, since exploitation requires local presence and no active exploitation is evidenced.

A malicious or compromised low-privilege application already present on a Huawei device abuses improper permission checks in the startup recovery module to read sensitive data it should not access and to disrupt device availability. No user interaction is required once the attacker's code is running locally, but initial local foothold (an installed app or local account) is a prerequisite. No public exploit code is known at this time.