HarmonyOS CVE-2026-49305

Exploitation requires that the attacker or malicious code have local execution capability on the target device - specifically, a locally running process (such as a sideloaded application) that can interact with the Wi-Fi enhancement module's permission control interface. The CVSS vector PR:N indicates no elevated privileges are required for the local process to trigger the flaw, meaning a standard (non-root) application can exploit it. No user interaction is needed once the malicious process is running. The vulnerability is limited to HarmonyOS versions 4.0.0, 4.2.0, 4.3.0, 4.3.1 and EMUI versions 14.0.0, 14.2.0, and 15.0.0 - devices on other versions or platforms are unaffected. Remote exploitation is not possible; the attacker must have achieved code execution on the device prior to triggering this vulnerability, whether through social engineering, app store compromise, or a separate vulnerability.

CVSS 6.2 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H quantifies a moderate-severity local availability issue. The local attack vector (AV:L) significantly constrains exploitability compared to network-facing vulnerabilities, but PR:N with AC:L means any locally running process - including a sideloaded or malicious app - can trigger the condition without elevated privileges or user interaction. EPSS data is not provided in the input; however, SSVC rates exploitation as 'none' and automatable as 'no', consistent with a targeted or on-device attack requiring app installation rather than mass exploitation. The High availability impact (A:H) represents denial of Wi-Fi functionality, which has operational consequences for mobile users but does not compromise confidentiality or integrity. A notable discrepancy exists: the input tags include 'Information Disclosure', yet the CVSS vector specifies C:N (no confidentiality impact) - this tag appears to be incorrectly applied or is a platform-level metadata artifact; the CVSS and description align on availability-only impact. Overall, this is a real but non-critical priority: relevant to device hardening and Huawei ecosystem deployments, but not an emergency without evidence of exploitation.

A malicious application installed on a Huawei device running HarmonyOS 4.x or EMUI 14.x/15.x sends a crafted sequence of permission-related requests to the Wi-Fi enhancement module, triggering an unhandled exceptional condition that crashes or hangs the Wi-Fi service. The device user loses Wi-Fi connectivity without warning, requiring a restart of the wireless subsystem or the device itself to recover. No public proof-of-concept code has been identified; the scenario requires local code execution on the target device.