OpenHarmony EUVD-2026-30831

Exploitation requires local code execution on the target OpenHarmony device with at least low-privilege credentials, as confirmed by the CVSS vector (AV:L/PR:L). The attacker must be able to run a process on the device - either as an installed application or through a previously established foothold. No user interaction is needed once the process is running (UI:N). Exploitation is limited to devices running OpenHarmony v6.0 or earlier; the specific internal feature or subsystem responsible for the improper permission preservation is not named in the available description, meaning the exact trigger condition (e.g., a specific API call, IPC mechanism, or file operation) is not confirmed from available data. Network-remote exploitation is not possible without a separate initial-access vulnerability providing local execution.

The CVSS base score of 5.5 (Medium) is broadly aligned with the real-world risk profile. The attack is constrained to local access (AV:L) and requires low privileges (PR:L), which significantly reduces the attack surface compared to network-exploitable flaws. However, C:H signals that successful exploitation yields high-value confidential data, not merely metadata. EPSS data was not provided in the intelligence feed, limiting probabilistic exploitation forecasting. KEV status is absent, indicating CISA has not confirmed active exploitation. No public proof-of-concept has been identified at time of analysis. The combination of low attack complexity (AC:L) and no user interaction (UI:N) means that once local access is obtained, exploitation requires minimal sophistication - raising the practical severity on shared or multi-tenant deployments of OpenHarmony. Overall this is a genuine medium-priority issue that becomes high priority in threat models involving malicious or compromised local applications, a realistic concern on consumer IoT and mobile devices.

An attacker who has installed a malicious application on a target OpenHarmony device - or who has compromised an existing low-privileged process - triggers the improper permissions preservation flaw to read a sensitive resource (such as a credential store, token, or protected configuration file) that their process should not have access to. Because attack complexity is low and no user interaction is required, the malicious application can execute this read silently in the background without alerting the device owner. No public proof-of-concept exploit code has been identified at time of analysis.