CVE-2025-58310CWE-843

CVE-2025-58310

High · published November 28, 2025

CVSS v3.1
8.0
EPSS
0%
Percentile
0.5
In the wild
Unconfirmed
What it is

⚡ This permission control vulnerability could let unauthorized users peek behind the curtain of your distributed system! 🔍 Think of this like a restaurant where anyone with a reservation can wander into the kitchen—suddenly, the recipe for your secret sauce is up for grabs! 🍽️ If exploited, this vulnerability may compromise the confidentiality of your service, allowing prying eyes to access sensitive data. The potential fallout could be absolutely devastating, leading to data leaks that harm users and erode trust.

Put simply

Think of this like a restaurant where anyone with a reservation can wander into the kitchen—suddenly, the recipe for your secret sauce is up for grabs! 🍽️ This vulnerability in the distributed component arises from inadequate permission controls, enabling unauthorized access to sensitive areas of the system. Without proper authentication checks, bad actors could gain insights they shouldn't have.

What to do

If exploited, this vulnerability may compromise the confidentiality of your service, allowing prying eyes to access sensitive data. The potential fallout could be absolutely devastating, leading to data leaks that harm users and erode trust. To protect against this vulnerability, immediately review and strengthen your permission controls. Implement stricter authentication measures and ensure that only authorized users can access sensitive data. Keep your systems updated as patches become available. You've got this! With the right steps, you can lock this down and keep your systems secure! 🛡️

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00091 · 0.5th percentile
Weakness
CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2025-11-28T08:15Z
Affected products (3)
ProductVersionsFixed in
huawei/harmonyosall versions—
huawei/harmonyosall versions—
huawei/harmonyosall versions—
References (1)
EPSS history
Timeline
  • 28 NOV 02:36Z
    Permission control vulnerability in the distributed component
    cvelistv5