169
CVEs
3
Critical
29
High
0
KEV
1
PoC
30
Unpatched C/H
3.0%
Patch Rate
0.0%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
29
MEDIUM
123
LOW
13
Monthly CVE Trend
Affected Products (30)
Harmonyos
815
Emui
549
Magic Ui
180
Secospace Usg6600 Firmware
43
Usg9500 Firmware
42
P30 Firmware
38
S5700 Firmware
28
Nip6800 Firmware
27
Mate 20 Firmware
27
P30 Pro Firmware
25
S7700 Firmware
23
P8 Firmware
22
Secospace Usg6300 Firmware
22
S6700 Firmware
21
Fusionsphere Openstack
21
Secospace Usg6500 Firmware
21
Cloudengine 12800 Firmware
21
Fusioncompute
19
S9700 Firmware
19
S9300 Firmware
18
Mate S Firmware
18
P9 Firmware
18
Uma
18
Ar3200 Firmware
17
S12700 Firmware
17
Mate 30 Firmware
16
Cloudengine 6800 Firmware
16
Nip6600 Firmware
16
P10 Plus Firmware
15
Cloudengine 7800 Firmware
15
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2020-37220 | Huawei HG630 V2 router contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain administrative access by retrieving the device serial number. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.7 | 0.1% | 64 |
PoC
No patch
|
| CVE-2026-34865 | Out-of-bounds heap write in Huawei HarmonyOS WEB module allows unauthenticated remote attackers to execute arbitrary code and exfiltrate sensitive data with no user interaction required. CVSS v4.0 score of 10.0 (Critical) reflects network-based exploitation with low complexity requiring no privileges or user interaction. No public exploit identified at time of analysis. The vulnerability achieves complete compromise of confidentiality, integrity, and availability across both vulnerable and subsequent system scopes. | CRITICAL | 10.0 | 0.0% | 50 |
No patch
|
| CVE-2026-28536 | Auth bypass in device authentication module. | CRITICAL | 9.6 | 0.0% | 48 |
No patch
|
| CVE-2025-64314 | Permission control vulnerability in the memory management module. Rated critical severity (CVSS 9.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.3 | 0.0% | 46 |
No patch
|
| CVE-2026-49310 | Unauthenticated remote availability disruption in Huawei HarmonyOS 6.1.0 allows network-accessible attackers to exploit missing permission controls in the event notification module, causing high-severity service outages that propagate beyond the vulnerable component via a scope change. The vulnerability is rooted in CWE-264 (Permissions, Privileges, and Access Controls) and carries a CVSS 3.1 base score of 8.6 with no privilege or user-interaction requirements. Huawei issued remediation guidance in its September 2026 security bulletin covering smartphones, Vision devices, wearables, and laptops; no public exploit code has been identified at time of analysis. | HIGH | 8.6 | 0.2% | 43 |
No patch
|
| CVE-2025-66324 | Input verification vulnerability in the compression and decompression module. Impact: Successful exploitation of this vulnerability may affect app data integrity. | HIGH | 8.4 | 0.0% | 42 |
No patch
|
| CVE-2025-66328 | Multi-thread race condition vulnerability in the network management module. Impact: Successful exploitation of this vulnerability may affect availability. | HIGH | 8.4 | 0.0% | 42 |
No patch
|
| CVE-2026-24930 | UAF concurrency vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability. [CVSS 8.4 HIGH] | HIGH | 8.4 | 0.0% | 42 |
No patch
|
| CVE-2026-41964 | Race condition in HarmonyOS web component enables local privilege escalation to full system compromise without authentication. The TOCTOU flaw (CWE-362) allows local attackers to achieve high confidentiality, integrity, and availability impact through unauthorized permission escalation. Huawei has released patches via May 2026 security bulletins for both mobile and laptop devices. EPSS data not yet available for this 2026 CVE; no confirmed active exploitation or public POC identified at time of analysis. | HIGH | 8.4 | 0.0% | 42 |
No patch
|
| CVE-2025-68957 | Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability. [CVSS 8.4 HIGH] | HIGH | 8.4 | 0.0% | 42 |
No patch
|
| CVE-2025-68960 | Multi-thread race condition vulnerability in the video framework module. Impact: Successful exploitation of this vulnerability may affect availability. [CVSS 8.4 HIGH] | HIGH | 8.4 | 0.0% | 42 |
No patch
|
| CVE-2026-24926 | Out-of-bounds write vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect availability. [CVSS 8.4 HIGH] | HIGH | 8.4 | 0.0% | 42 |
No patch
|
| CVE-2025-58303 | UAF vulnerability in the screen recording framework module. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.4 | 0.0% | 42 |
No patch
|
| CVE-2025-58302 | Permission control vulnerability in the Settings module. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.4 | 0.0% | 42 |
No patch
|
| CVE-2025-68955 | Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability. [CVSS 8.0 HIGH] | HIGH | 8.0 | 0.0% | 40 |
No patch
|