Monthly
Improper permission enforcement in the notification module of Huawei HarmonyOS and EMUI permits a local, unprivileged process to interfere with notification handling, resulting in limited integrity and availability impact. Affected versions span HarmonyOS 4.0.0 through 4.3.1 and EMUI 14.0.0 through 15.0.0 across Huawei consumer devices. No public exploit code or active exploitation has been identified at time of analysis; Huawei disclosed this via its August 2026 security bulletin.
Improper permission controls in the HarmonyOS 6.1.0 clipboard module expose confidential data to local attackers. The flaw, classified under CWE-264 (Permissions, Privileges, and Access Controls), allows a local actor who can induce user interaction to read clipboard contents without appropriate authorization, impacting confidentiality only. No active exploitation is confirmed by CISA KEV, and SSVC rates exploitation status as none with no automation potential.
Permission control failure in HarmonyOS 6.1.0's device key management module allows a local, unprivileged actor to cause a complete availability loss on the vulnerable system. The flaw is classified under CWE-264 (Permissions, Privileges, and Access Controls), indicating improper enforcement of access restrictions within the key management subsystem. SSVC assessment confirms no known exploitation and non-automatable attack, but the local-no-privilege vector lowers the bar for any co-located attacker or malicious app on the device.
Permission control failure in the Bluetooth module of Huawei HarmonyOS and EMUI exposes devices to local exploitation that can degrade Bluetooth service availability and leak limited data. The flaw, classified under CWE-264, allows a local process operating without elevated privileges to bypass Bluetooth permission enforcement, potentially disrupting connectivity or reading restricted information. No public exploit or CISA KEV listing exists at time of analysis, but Huawei has disclosed this via its July 2026 security bulletin.
Permission bypass in the HarmonyOS card module allows a local, unprivileged user - with required user interaction - to circumvent access controls, resulting in high availability impact alongside limited confidentiality and integrity exposure. The vulnerability affects Huawei HarmonyOS across all tracked versions per CPE data and is documented in Huawei's July 2026 security bulletin. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world risk constrained to local attack scenarios.
Permission control weakness in the service notifications component of Huawei HarmonyOS and EMUI allows a local, unprivileged attacker - with user interaction - to partially degrade availability across a changed scope boundary. Rooted in CWE-264 (Permissions, Privileges, and Access Controls), the flaw permits improper manipulation of notification service permissions, with impact reaching beyond the immediately vulnerable component as indicated by the CVSS Scope:Changed attribute. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the low CVSS score of 3.6 reflects constrained real-world impact limited to availability.
HarmonyOS app management and control module permits local privilege escalation through improper permission controls, allowing unauthenticated local attackers with user interaction to access confidential service data. CVSS 3.6 (low severity) reflects local-only attack vector and requirement for user interaction, though the privilege escalation nature means affected systems warrant review for deployment context.
Cisco IOS XR Software contains a task group mapping flaw in a specific CLI command that allows authenticated local attackers to bypass privilege checks and gain full administrative access to affected devices. An attacker with low-privileged credentials can exploit this misconfiguration to execute unauthorized administrative actions without proper authorization validation. No patch is currently available.
Harmonyos versions up to 5.1.0 is affected by permissions, privileges, and access controls (CVSS 4.0).
Harmonyos versions up to 5.1.0 is affected by permissions, privileges, and access controls (CVSS 3.3).
Improper permission enforcement in the notification module of Huawei HarmonyOS and EMUI permits a local, unprivileged process to interfere with notification handling, resulting in limited integrity and availability impact. Affected versions span HarmonyOS 4.0.0 through 4.3.1 and EMUI 14.0.0 through 15.0.0 across Huawei consumer devices. No public exploit code or active exploitation has been identified at time of analysis; Huawei disclosed this via its August 2026 security bulletin.
Improper permission controls in the HarmonyOS 6.1.0 clipboard module expose confidential data to local attackers. The flaw, classified under CWE-264 (Permissions, Privileges, and Access Controls), allows a local actor who can induce user interaction to read clipboard contents without appropriate authorization, impacting confidentiality only. No active exploitation is confirmed by CISA KEV, and SSVC rates exploitation status as none with no automation potential.
Permission control failure in HarmonyOS 6.1.0's device key management module allows a local, unprivileged actor to cause a complete availability loss on the vulnerable system. The flaw is classified under CWE-264 (Permissions, Privileges, and Access Controls), indicating improper enforcement of access restrictions within the key management subsystem. SSVC assessment confirms no known exploitation and non-automatable attack, but the local-no-privilege vector lowers the bar for any co-located attacker or malicious app on the device.
Permission control failure in the Bluetooth module of Huawei HarmonyOS and EMUI exposes devices to local exploitation that can degrade Bluetooth service availability and leak limited data. The flaw, classified under CWE-264, allows a local process operating without elevated privileges to bypass Bluetooth permission enforcement, potentially disrupting connectivity or reading restricted information. No public exploit or CISA KEV listing exists at time of analysis, but Huawei has disclosed this via its July 2026 security bulletin.
Permission bypass in the HarmonyOS card module allows a local, unprivileged user - with required user interaction - to circumvent access controls, resulting in high availability impact alongside limited confidentiality and integrity exposure. The vulnerability affects Huawei HarmonyOS across all tracked versions per CPE data and is documented in Huawei's July 2026 security bulletin. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world risk constrained to local attack scenarios.
Permission control weakness in the service notifications component of Huawei HarmonyOS and EMUI allows a local, unprivileged attacker - with user interaction - to partially degrade availability across a changed scope boundary. Rooted in CWE-264 (Permissions, Privileges, and Access Controls), the flaw permits improper manipulation of notification service permissions, with impact reaching beyond the immediately vulnerable component as indicated by the CVSS Scope:Changed attribute. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the low CVSS score of 3.6 reflects constrained real-world impact limited to availability.
HarmonyOS app management and control module permits local privilege escalation through improper permission controls, allowing unauthenticated local attackers with user interaction to access confidential service data. CVSS 3.6 (low severity) reflects local-only attack vector and requirement for user interaction, though the privilege escalation nature means affected systems warrant review for deployment context.
Cisco IOS XR Software contains a task group mapping flaw in a specific CLI command that allows authenticated local attackers to bypass privilege checks and gain full administrative access to affected devices. An attacker with low-privileged credentials can exploit this misconfiguration to execute unauthorized administrative actions without proper authorization validation. No patch is currently available.
Harmonyos versions up to 5.1.0 is affected by permissions, privileges, and access controls (CVSS 4.0).
Harmonyos versions up to 5.1.0 is affected by permissions, privileges, and access controls (CVSS 3.3).