What is the CVSS score of CVE-2026-58554?

CVE-2026-58554 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.1%.

HarmonyOS CVE-2026-58554

EUVD-2026-44659 MEDIUM

Information Exposure (CWE-200)

2026-07-15 huawei

GHSA-v7px-ccwm-rfj6

Information Disclosure Harmonyos Emui

6.6

CVSS 3.1 · Vendor: huawei

Severity by source

Vendor (huawei) PRIMARY

6.6 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

vuln.today AI

6.6 MEDIUM

Local-only vector confirmed; PR:N reflects that any installed app exploits the Settings IPC boundary without requesting elevated permissions, with user interaction as the sole trigger gate.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (huawei).

CVSS VectorVendor: huawei

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 13:23 vuln.today

DescriptionCVE.org

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

AnalysisAI

Permission control bypass in the Settings module of Huawei HarmonyOS and EMUI exposes sensitive service data to unauthorized local actors. A locally-installed application without elevated privileges can exploit the flaw (CWE-200) during user interaction with the Settings UI to read confidential configuration or service data - with a CVSS-rated High confidentiality impact (C:H). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in the Settings module of Huawei's HarmonyOS and EMUI operating systems (CPE: cpe:2.3:a:huawei:harmonyos:* and cpe:2.3:a:huawei:emui:*). CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause as insufficient access control enforcement - the Settings module fails to properly verify that a requesting actor has authorization to read protected data. In mobile OS architectures such as HarmonyOS and EMUI, this class of flaw typically manifests in inter-process communication (IPC) channels, content provider access controls, or permission declaration gaps that allow lower-privileged components to query sensitive system configuration state. The CVSS local attack vector confirms the flaw is exercised on-device rather than over a network, consistent with a Settings IPC boundary weakness.

RemediationAI

Consult and apply the update detailed in Huawei's July 2026 security bulletin (https://consumer.huawei.com/en/support/bulletin/2026/7/) - the patch is available per vendor advisory, though exact fixed version numbers are not confirmed in the data available at time of analysis and must be retrieved directly from the bulletin. As compensating controls while patching, disable the 'Install unknown apps' or sideloading capability on all Huawei devices (Settings > Security) to prevent delivery of malicious applications that would be required to trigger the flaw; note this does not protect against apps already installed or delivered via compromised official channels. Additionally, audit and remove untrusted or unnecessary third-party applications to reduce the local attack surface. These mitigations reduce likelihood but do not remediate the underlying permission control defect.