What is the CVSS score of CVE-2026-41966?

CVE-2026-41966 has a CVSS 3.1 base score of 5.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Huawei HarmonyOS CVE-2026-41966

EUVD-2026-30528 MEDIUM

Business Logic Errors (CWE-840)

2026-05-15 huawei

GHSA-j276-f994-hf7m

Information Disclosure

5.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.6 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 10:30 vuln.today

CVE Published

May 15, 2026 - 09:26 nvd

MEDIUM 5.6

DescriptionCVE.org

Permission control vulnerability in the smart sensing service. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

AnalysisAI

Permission control vulnerability in Huawei HarmonyOS smart sensing service allows remote attackers to bypass access controls and disclose sensitive information with moderate complexity. The vulnerability affects service confidentiality and integrity across HarmonyOS versions, with CVSS 5.6 (AV:N/AC:H/PR:N/UI:N) indicating network-accessible exploitation requiring non-trivial conditions. No active exploitation in CISA KEV or public exploit code identified at time of analysis.

Technical ContextAI

The vulnerability resides in HarmonyOS's smart sensing service, a permission-sensitive component responsible for managing access to device sensor data and system capabilities. CWE-840 (Use of Inadequately Specified Permissions) indicates the root cause is insufficient or improperly enforced permission checks within the service's request validation logic. The network attack vector (AV:N) suggests the service accepts remote requests, likely via inter-process communication (IPC) or network APIs, while the high attack complexity (AC:H) implies exploitation requires overcoming non-default configurations, timing conditions, or specific service states. The partial scope unchanged (S:U) and limited impact (C:L, I:L, A:L) suggest the vulnerability grants access to a narrow subset of sensor data or temporary disruption rather than full system compromise.

RemediationAI

Consult Huawei's official security bulletin at https://consumer.huawei.com/en/support/bulletin/2026/5/ for patch availability and exact fix versions specific to your HarmonyOS device model and build. If vendor-released patches are available, apply them immediately to the smart sensing service component. If patching is not yet available or delays are expected, implement compensating controls: disable or restrict network access to the smart sensing service via firewall rules or SELinux/AppArmor policies, disable sensor APIs for untrusted remote callers, enforce strict input validation on service requests, and monitor smart sensing service logs for anomalous permission requests. Note that disabling sensing features may impact legitimate smart home automation or health-tracking functionality - validate impacts on user workflows before deployment.