File-system permission-control vulnerability in Huawei Harmony OS and EMUI

Permission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

• Huawei Harmony OS: the normalized record marks 4.3.1, 4.3.0, 4.2.0, and 4.0.0 as affected. The HUAWEI phones/tablets bulletin lists the same versions.
• HUAWEI Vision: the Vision-specific bulletin lists HarmonyOS4.3.0 as affected. Do not automatically extend the Vision-specific statement to every other HarmonyOS branch without product-specific confirmation.
• Huawei EMUI: the normalized record and the phones/tablets bulletin list 15.0.0, 14.2.0, and 14.0.0 as affected.
• The record's default status is unaffected outside the explicitly listed versions, but no fixed release is identified. The status of other or later branches is therefore not independently established by the available evidence.

The weakness is described as a permission-control flaw in the file system and is mapped to CWE-840, Business Logic Errors. The available evidence does not identify the affected file-system operation, API, path, permission check, or attacker-controlled data. The supplied assessment describes a local attack path with low complexity, no privileges required, and required user interaction. Scope is unchanged, so the evidence does not establish access beyond the affected service or security authority. Successful exploitation may affect service confidentiality; the supplied assessment also indicates high potential impact to integrity and availability, but Huawei does not explain how those outcomes arise. The precise precondition that requires user interaction and the affected implementation component remain unknown.

Reachability is local, not network-based, according to the supplied assessment. No privileges are required, attack complexity is low, and user interaction is required. The supplied record marks public exploit false. The CISA SSVC data displayed in NVD records exploitation as none and automatable as no; this is a point-in-time assessment and does not prove that the flaw cannot be exploited. The evidence provides no exploit steps, payload, or specific trigger.

Successful exploitation could expose information that the service or file system is intended to protect because of an incorrect permission decision. The supplied assessment also indicates high potential impact to confidentiality, integrity, and availability, but the vendor description does not specify the files, services, or operations involved. Because the path is local and user interaction is required, this is not established as a directly remotely reachable issue. The record does not establish privilege escalation or cross-scope impact; scope is unchanged. Consequences for a particular organization depend on what sensitive data the affected service stores or accesses.

The direct documented consequence is possible loss of service confidentiality. In an affected deployment, a permission-control failure could expose data that the service or file system is intended to protect, but the evidence does not identify specific data classes or records. The supplied impact assessment also indicates possible integrity and availability consequences, so operators should not assume confidentiality is the only risk; Huawei does not describe the concrete modification or disruption path. No breach, victim, or observed abuse is identified in the evidence reviewed.

1. Inventory Huawei devices and identify the product line, deployment type, and operating-system version in use.
2. For phones and tablets, treat Harmony OS 4.3.1, 4.3.0, 4.2.0, and 4.0.0 together with EMUI 15.0.0, 14.2.0, and 14.0.0 as affected. For HUAWEI Vision, separately check HarmonyOS 4.3.0 as listed by the Vision bulletin.
3. Install the applicable HUAWEI security update containing the patch for the affected product. The available evidence confirms that the update includes the patch but does not state an exact fixed release, so do not infer a universal fixed version or an open-ended range covering all later versions.
4. No vendor-specific workaround or mitigation is provided in the available evidence. If an update cannot yet be deployed, record the device as unverified rather than treating the absence of logs or IOCs as evidence of safety.

• Inventory Huawei devices running Harmony OS or EMUI and distinguish phone/tablet deployments from HUAWEI Vision.
• Compare each device's operating-system version with the affected versions listed in the record and the corresponding vendor bulletin.
• Check the installed Huawei security-update state for each product; the available evidence does not identify one fixed build that can be used as a universal confirmation point.
• For HUAWEI Vision, use the Vision-specific bulletin rather than extending the phone/tablet bulletin's scope to every HarmonyOS branch.
• No specific log event, IOC, file path, or endpoint is provided. Monitoring for unusual access to protected service data is only a general precaution, not a confirmed indicator.