HarmonyOS EUVD-2026-60071

Exploitation requires local code execution on a HarmonyOS 6.1.0 device - specifically, the ability to invoke APIs in the device key management module from an unprivileged context. The CVSS PR:N metric indicates no prior privileges are required; any locally executing application or process can attempt exploitation. No network access, no user interaction, and no special system configuration are required beyond having local execution on the target device. Exploitation is limited to HarmonyOS 6.1.0 and is constrained by physical or logical access to the device (AV:L); remote attackers without a pre-existing foothold on the device cannot exploit this directly. SSVC confirms the attack is not automatable, suggesting reliable exploitation may require device-specific conditions or timing.

The CVSS 3.1 base score of 6.2 (Medium) reflects a local attack vector with no privilege requirement and high availability impact, but no confidentiality or integrity impact (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). This is an unusual combination: PR:N on a local vector means any process or app running on the device - without elevated rights - can trigger the flaw. SSVC signals corroborate a measured response: exploitation is currently 'none,' the attack is not automatable (SSVC: Automatable: no), and technical impact is only partial. There is no CISA KEV listing and no public exploit identified. EPSS data is not provided in the source intelligence, limiting probabilistic exploitation forecasting. The 'Privilege Escalation' tag in the source intelligence appears inconsistent with the CVSS impact metrics (C:N/I:N), suggesting the tag may reflect the nature of the vulnerable module rather than a confirmed privilege escalation outcome - defenders should verify with the vendor advisory whether escalation of privilege is achievable or if the impact is strictly a denial-of-service. Overall, this is a credible but currently low-exploitation-pressure finding, appropriate for standard patching cycles rather than emergency response.

A malicious application installed on a HarmonyOS 6.1.0 device - without requiring any special permissions - invokes key management module APIs that should be restricted to privileged callers, triggering an unhandled state that crashes or hangs the subsystem and rendering the device or affected service unavailable. No public proof-of-concept code has been identified at time of analysis, and SSVC confirms exploitation is currently not observed.