What is the CVSS score of CVE-2026-58557?

CVE-2026-58557 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.1%.

HarmonyOS CVE-2026-58557

EUVD-2026-44660 MEDIUM

Weaknesses Introduced During Design (CWE-701)

2026-07-15 huawei

GHSA-fr78-wfr2-4mhm

Information Disclosure Harmonyos

4.8

CVSS 3.1 · Vendor: huawei

Severity by source

Vendor (huawei) PRIMARY

4.8 MEDIUM

AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H

vuln.today AI

4.8 MEDIUM

Local-only access with mandatory high privileges and user interaction; availability impact is high but no confidentiality impact is substantiated by available technical evidence.

3.1 AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (huawei).

CVSS VectorVendor: huawei

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 13:20 vuln.today

DescriptionCVE.org

Design defect vulnerability in Expedition mode. Impact: Successful exploitation of this vulnerability may affect availability.

AnalysisAI

Design defect in HarmonyOS's 'Expedition mode' allows a high-privileged local attacker, with user interaction, to cause significant availability disruption and minor integrity impact. Reported by Huawei in its July 2026 security bulletin, the vulnerability carries a CVSS 3.1 base score of 4.8, reflecting constrained exploitability due to local access, high privilege, and required user interaction. No public exploit code has been identified, and the flaw does not appear in the CISA KEV catalog. Notably, the 'Information Disclosure' tag associated with this CVE is inconsistent with the CVSS confidentiality metric of C:N - this discrepancy should be verified against the vendor advisory.

Technical ContextAI

HarmonyOS is Huawei's proprietary operating system deployed across smartphones, tablets, and IoT devices, identified via CPE cpe:2.3:a:huawei:harmonyos:*:*:*:*:*:*:*:*. The vulnerability resides in 'Expedition mode,' a HarmonyOS-specific feature whose exact function is not elaborated in available data but appears to be a device operational mode or performance state. The root cause is classified under CWE-701, which relates to design defects - a structural flaw in how the feature was architected rather than a traditional memory corruption or input validation error. The CVSS vector AV:L/PR:H/UI:R indicates the flaw can only be reached locally by a high-privileged user who triggers some form of user interaction, pointing to a mode-switching or configuration operation that is incorrectly designed with respect to availability and integrity guarantees.

RemediationAI

The primary remediation is to apply the patch or update referenced in Huawei's July 2026 security bulletin at https://consumer.huawei.com/en/support/bulletin/2026/7/. No specific fixed version number is confirmed from available data - the exact patched release must be obtained directly from the bulletin. As a compensating control pending patch deployment, restricting or disabling access to 'Expedition mode' on affected devices - if that capability is exposed via a settings interface - would reduce the attack surface, though this may impact performance features the mode provides. On managed enterprise HarmonyOS deployments, enforcing device management policies that prevent high-privileged local access by untrusted operators reduces exploitation prerequisites, given that PR:H is a hard requirement for this vulnerability.