Harmonyos
CVE-2026-28536
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to local network segment
-
ExploitSend crafted authentication request
-
ExecutionBypass device authentication module
-
ImpactGain unauthorized access to device resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Primary weakness mitigation
|
| Exploitation Conditions | Device must be accessible on the same local network segment (AV:A). No authentication credentials required. Affects devices with default or unmodified authentication configurations accepting local network connections. |
| Impact | CVSS 9.6. |
| Exploit ScenarioDerived | Bypass device authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Auth bypass in device authentication module.
Earlier versions of this analysis (1)
Device auth bypass.
RemediationAI
Apply patch.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-305.
Know when Harmonyos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Authentication bypass vulnerability in the device authentication module. Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.
Executive ViewAI
A critical authentication bypass vulnerability (CVE-2026-28536, CVSS 9.6) has been identified in our device authentication module with no vendor patch currently available. Threat actors could exploit this to gain unauthorized access to systems, compromising data confidentiality and integrity across affected infrastructure. Immediate mitigation measures are required to prevent potential breach.
Implement strict network segmentation isolating affected devices; deploy web application firewall (WAF) rules to detect and block exploitation attempts; disable non-essential authentication features if possible; enforce additional authentication factors (MFA) where supported; restrict administrative access via IP whitelisting; increase logging and monitoring with SIEM alerting on failed authentication attempts; implement rate limiting on authentication endpoints; consider vendor workarounds or temporary feature disablement until patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Out-of-bounds heap write in Huawei HarmonyOS WEB module allows unauthenticated remote attackers to execute arbitrary cod
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
GitHub PoC
Exploit-DB