EUVD-2025-208677
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3Description
in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input. This vulnerability can be exploited only in restricted scenarios.
Analysis
OpenHarmony v5.0.3 and prior versions contain an improper input validation vulnerability (CWE-20) that allows a local attacker with limited privileges to read sensitive information from the system. The vulnerability carries a CVSS score of 3.3 with low attack complexity and requires local access and low privileges, indicating a confined risk profile suitable only for restricted exploitation scenarios. While the CVSS vector does not indicate active exploitation or widespread POC availability based on the provided data, the information disclosure impact warrants attention in environments where local privilege escalation chains may amplify the risk.
Technical Context
The vulnerability stems from improper input validation in OpenHarmony, a component-based open-source operating system developed by Huawei. CWE-20 (Improper Input Validation) is the underlying weakness—the system fails to correctly validate, filter, or sanitize user-supplied input before processing, potentially allowing attackers to bypass security controls or access unintended data paths. The affected attack surface is localized to the user/application layer rather than kernel-level or network-facing interfaces, as indicated by the AV:L (Attack Vector: Local) designation in the CVSS vector. The vulnerability does not permit modification (I:N) or denial of service (A:N), limiting the impact to confidentiality breaches (C:L).
Affected Products
OpenHarmony versions 5.0.3 and all prior releases are affected by this vulnerability. The vendor advisory and patch availability details were not provided in the intelligence sources; organizations should consult the OpenHarmony project repository (https://gitee.com/openharmony) and Huawei's security bulletins for official CVE-2025-26474 guidance, patch announcements, and specific CPE identifiers (typically in the form cpe:2.3:o:huawei:openharmony). Administrators managing OpenHarmony deployments in IoT, embedded, or edge computing environments should determine whether their specific product variant and version fall within the affected range.
Remediation
Upgrade OpenHarmony to version 5.0.4 or later once patches are released by the vendor; monitor the official OpenHarmony repository and Huawei security advisories for patch availability and detailed CVE-2025-26474 mitigation guidance. As an interim measure, restrict local user account creation and enforce principle-of-least-privilege (PoLP) on systems running affected versions—disable unnecessary local user accounts, audit and minimize the set of users with shell or application execution privileges, and employ mandatory access controls (MAC) if the OpenHarmony configuration supports SELinux or similar frameworks. In containerized or virtualized deployments, enforce stricter resource and namespace isolation to limit the attack surface for local attackers. Conduct a local threat assessment to identify systems where local attackers are plausible (shared hosting, development environments, compromised endpoints) and prioritize patching in those contexts first.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today