HarmonyOS CVE-2026-58554

Exploitation requires a malicious or attacker-controlled application to be installed on the target Huawei device running HarmonyOS or EMUI. The CVSS vector confirms the attacking application does not require elevated OS permissions (PR:N), meaning an ordinary low-privilege app can trigger the flaw. User interaction with the Settings module is required (UI:R), meaning the vulnerability cannot be exploited passively while Settings is unused - the user must actively open or navigate Settings to trigger the permission control failure. The attack vector is strictly local (AV:L), excluding all remote or network-based exploitation paths. Limiting factors for defenders: the device must have an attacker-controlled app installed, and the user must interact with Settings during the attack window. The specific Settings sub-module, content provider URI, or IPC call path that triggers the bypass is not identified in available data.

The CVSS score of 6.6 (Medium) reflects meaningful but bounded risk: the local attack vector (AV:L) eliminates remote exploitation, and user interaction is required (UI:R), preventing silent background exploitation. The unusual combination of PR:N with AV:L in the CVSS vector indicates that an installed application - without requesting elevated permissions - can trigger the vulnerability, which is plausible in mobile OS IPC scenarios where permission checks are enforced in the called module rather than gated by the caller's permission set. The High confidentiality impact (C:H) is the primary risk driver, with Low integrity and availability impacts adding marginal concern. No EPSS score was provided in the available data. The vulnerability is absent from CISA KEV and no proof-of-concept code has been publicly identified at time of analysis, suggesting no confirmed opportunistic or widespread exploitation. Real-world risk is moderate: the threat model requires a malicious application already resident on the device, and user interaction with Settings acts as a triggering constraint. This is meaningfully lower risk than the raw CVSS score might suggest if assessed against a network-vector benchmark.

An attacker distributes a malicious application - via a third-party app store, phishing link, or social engineering - to a target's Huawei HarmonyOS or EMUI device. When the user opens or otherwise interacts with the Settings module, the malicious app exploits the permission control bypass to read restricted service configuration data, potentially exposing account identifiers, system credentials, or sensitive configuration parameters. No public proof-of-concept exploit code has been identified at time of analysis.