Skip to main content

Huawei HarmonyOS EUVDEUVD-2026-30528

| CVE-2026-41966 MEDIUM
Business Logic Errors (CWE-840)
2026-05-15 huawei GHSA-j276-f994-hf7m
Information Disclosure Harmonyos Huawei
5.6
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.6 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

2
Analysis Generated
May 15, 2026 - 10:30 vuln.today
CVE Published
May 15, 2026 - 09:26 nvd
MEDIUM 5.6

DescriptionCVE.org

Permission control vulnerability in the smart sensing service. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

AnalysisAI

Permission control vulnerability in Huawei HarmonyOS smart sensing service allows remote attackers to bypass access controls and disclose sensitive information with moderate complexity. The vulnerability affects service confidentiality and integrity across HarmonyOS versions, with CVSS 5.6 (AV:N/AC:H/PR:N/UI:N) indicating network-accessible exploitation requiring non-trivial conditions. No active exploitation in CISA KEV or public exploit code identified at time of analysis.

Technical ContextAI

The vulnerability resides in HarmonyOS's smart sensing service, a permission-sensitive component responsible for managing access to device sensor data and system capabilities. CWE-840 (Use of Inadequately Specified Permissions) indicates the root cause is insufficient or improperly enforced permission checks within the service's request validation logic. The network attack vector (AV:N) suggests the service accepts remote requests, likely via inter-process communication (IPC) or network APIs, while the high attack complexity (AC:H) implies exploitation requires overcoming non-default configurations, timing conditions, or specific service states. The partial scope unchanged (S:U) and limited impact (C:L, I:L, A:L) suggest the vulnerability grants access to a narrow subset of sensor data or temporary disruption rather than full system compromise.

RemediationAI

Consult Huawei's official security bulletin at https://consumer.huawei.com/en/support/bulletin/2026/5/ for patch availability and exact fix versions specific to your HarmonyOS device model and build. If vendor-released patches are available, apply them immediately to the smart sensing service component. If patching is not yet available or delays are expected, implement compensating controls: disable or restrict network access to the smart sensing service via firewall rules or SELinux/AppArmor policies, disable sensor APIs for untrusted remote callers, enforce strict input validation on service requests, and monitor smart sensing service logs for anomalous permission requests. Note that disabling sensing features may impact legitimate smart home automation or health-tracking functionality - validate impacts on user workflows before deployment.

More in Harmonyos

View all
CVE-2026-34865 CRITICAL
10.0 Apr 13

Out-of-bounds heap write in Huawei HarmonyOS WEB module allows unauthenticated remote attackers to execute arbitrary cod
CVE-2024-32991 CRITICAL
9.8 May 14

Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
CVE-2023-46773 CRITICAL
9.8 Dec 06

Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
CVE-2023-44116 CRITICAL
9.8 Oct 11

Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this

CVE-2023-44105 CRITICAL
9.8 Oct 11

Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
CVE-2023-44106 CRITICAL
9.8 Oct 11

API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
CVE-2023-41297 CRITICAL
9.8 Sep 25

Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
CVE-2023-41294 CRITICAL
9.8 Sep 25

The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super

CVE-2023-39405 CRITICAL
9.8 Aug 13

Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
CVE-2023-37242 CRITICAL
9.8 Jul 06

Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
CVE-2022-46327 CRITICAL
9.8 Dec 20

Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
CVE-2022-46326 CRITICAL
9.8 Dec 20

Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r

Same weakness CWE-840 – Business Logic Errors

View all
CVE-2022-4719 CRITICAL POC
9.8
CVE-2022-32207 CRITICAL POC
9.8
CVE-2022-0935 HIGH POC
8.8
CVE-2025-1908 HIGH POC
7.7
CVE-2021-22926 HIGH POC
7.5
CVE-2022-27782 HIGH POC
7.5
CVE-2022-1155 HIGH POC
7.4
CVE-2024-1456 HIGH POC
7.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-30528 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy