CVE-2025-58308CWE-358

CVE-2025-58308

High · published November 28, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
0.3
In the wild
Unconfirmed
What it is

⚡ An improper security check in the call module can lead to unexpected behavior! Think of it as a bouncer at a club who doesn’t check IDs properly! 🎟️ Imagine a busy restaurant where the chef accepts orders without verifying the diners' preferences. This oversight can lead to disastrous meals served to unsuspecting guests, just like this vulnerability allows features to run amok without the right checks in place. If exploited, this vulnerability could cause crucial features to misbehave, potentially leading to data discrepancies or performance issues that disrupt normal operations. In the worst-case scenario, it could compromise the integrity of the system, leaving users frustrated and confused!

Put simply

Imagine a busy restaurant where the chef accepts orders without verifying the diners' preferences. This oversight can lead to disastrous meals served to unsuspecting guests, just like this vulnerability allows features to run amok without the right checks in place. This vulnerability arises from an improper criterion security check within the call module, allowing unauthorized actions that should normally be restricted based on specific conditions.

What to do

If exploited, this vulnerability could cause crucial features to misbehave, potentially leading to data discrepancies or performance issues that disrupt normal operations. In the worst-case scenario, it could compromise the integrity of the system, leaving users frustrated and confused! To remediate this vulnerability, immediately update to the latest version that addresses this issue. Conduct a thorough audit of all modules utilizing the call feature to ensure no further improper checks exist. Implement strict validation to prevent any unauthorized access. You’ve got this! By following these steps, you’ll shield your system from unwanted surprises! 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00084 · 0.3th percentile
Weakness
CWE-358 · Improperly Implemented Security Check for Standard
Published
2025-11-28T09:16Z
Affected products (3)
ProductVersionsFixed in
huawei/harmonyosall versions—
huawei/harmonyosall versions—
huawei/harmonyosall versions—
References (1)
EPSS history
Timeline
  • 28 NOV 03:04Z
    Vulnerability of improper criterion security check in the call module
    cvelistv5