EUVD-2026-35323
GHSA-j23c-xwww-crv4
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Primary rating from Vendor (huawei) · only source for this CVE.
CVSS VectorVendor: huawei
Lifecycle Timeline
1DescriptionCVE.org
Permission control vulnerability in the clone module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AnalysisAI
Permission control vulnerability in the HarmonyOS clone module allows a local attacker to read confidential service data, with low confidentiality and availability impact. The flaw stems from improper permission enforcement (CWE-275) during clone operations and requires user interaction to trigger. No public exploit code exists and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Technical ContextAI
HarmonyOS, Huawei's proprietary operating system (CPE: cpe:2.3:a:huawei:harmonyos:*:*:*:*:*:*:*:*), includes a clone module - a component that facilitates duplication of application data or application instances. The root cause class is CWE-275 (Permission Issues), indicating that access controls governing what the clone operation can read or expose are incorrectly implemented. Specifically, the clone module likely fails to validate or enforce appropriate permission boundaries when copying or accessing service data, allowing a process or user without sufficient authorization to read data that should be restricted. The Huawei laptop security bulletin reference (bulletinlaptops) suggests this affects HarmonyOS deployments on laptop or PC-class hardware rather than mobile devices exclusively.
RemediationAI
Consult the Huawei June 2026 laptop security bulletin at https://consumer.huawei.com/en/support/bulletinlaptops/2026/6/ for the specific patched HarmonyOS build version and apply the vendor-provided update as the primary remediation. An exact fixed version number is not independently confirmed from the available input data - the bulletin must be reviewed directly. As a compensating control pending patch application, restrict physical and remote access to affected devices to trusted users only, which addresses the local attack vector requirement. Additionally, user awareness around accepting or initiating unexpected clone operations can reduce the user interaction (UI:R) prerequisite for exploitation. No known trade-offs from the patch are documented in available data.
Out-of-bounds heap write in Huawei HarmonyOS WEB module allows unauthenticated remote attackers to execute arbitrary cod
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
Same weakness CWE-275 – Permission Issues
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today