Huawei HarmonyOS CVE-2026-101181

Exploitation requires local access to a HarmonyOS device plus at least low-level privileges (PR:L) - i.e., the attacker must already have code running on the device, typically via an installed or malicious application, rather than remote network access. The flaw is in the WLAN module's permission/access control, so a successful attack depends on reaching that module's interface from an under-privileged context; no user interaction is required (UI:N). Limiting factors: the attacker cannot exploit this remotely or unauthenticated, cannot modify data or cause disruption (I:N/A:N - confidentiality impact only), and the scope is unchanged (S:U). The specific configuration, affected HarmonyOS versions, and exact triggering conditions within the WLAN module are not described in the available sources.

This is a moderate-severity local information-disclosure issue, not a high-urgency remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) indicates that exploitation requires local access and at least low privileges already present on the device, with no integrity or availability impact - only confidentiality is affected. There is no EPSS score supplied, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is provided, so there is no public exploit identified at time of analysis. The vendor priority label is 'this_month', which is consistent with a patch-on-normal-cycle item rather than an emergency: the signals align (local vector, requires privileges, confidentiality-only, no exploitation evidence) and do not conflict. The main caveat is that the description is extremely terse ('Permission control vulnerability in the WLAN module') and does not explain the mechanism, so the precise data exposed and the exact privilege boundary crossed cannot be verified from the available sources.

A malicious or low-privilege app already installed on a HarmonyOS device abuses a permission-control flaw in the WLAN module to read WLAN-related information it should not have access to, such as network configuration or other confidential service data. Because the CVSS vector is local (AV:L) with low complexity and low privileges, the attacker needs code or an app running on the device but no user interaction and no elevated rights. No public exploit code or PoC is identified for this CVE.