Paper/Archive/CVE-2023-44116

CVE-2023-44116

Huawei HarmonyOS — Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this vulnerability may…

EPSS 0.4%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 39.2.392 × 207.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this vulnerability may cause some apps to run without being authorized.

Affected

ProductAffectedFixed inSource

HarmonyOS4.0.0–CNA

HarmonyOS3.1.0–CNA

HarmonyOS3.0.0–CNA

HarmonyOS2.1.0–CNA

HarmonyOS2.0.1–CNA

HarmonyOS2.0.0–CNA

EMUI13.0.0–CNA

EMUI12.0.1–CNA

EMUI12.0.0–CNA

EMUI11.0.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refconsumer.huawei.com/en/support/bulletin/2023/10 refdevice.harmonyos.com/en/docs/security/update/security-bulletins-202310-0000001663676540