The vulnerability originates from insufficient permission checks in the event notification management module of Huawei EMUI and HarmonyOS. Its primary consequence is the potential exposure of service‑level confidential information to an attacker who can manipulate event notifications. The weakness is a classic privileged escalation issue, classified under CWE-264. The impact is limited to confidentiality; integrity or availability are not directly affected based on the description.

The affected platforms are Huawei EMUI and Huawei HarmonyOS. No specific firmware or OS version ranges are provided, so all releases built on the event notification management components are potentially vulnerable.

The CVSS score of 7.1 indicates a high severity rating. EPSS information is unavailable, and the vulnerability is not included in CISA's KEV catalog. The likely attack vector is based on the permissions model: an attacker with local access could elevate privileges by abusing the notification system, or a remote attacker might exploit exposed notification APIs if the device accepts network input. However, the precise exploitation path is not detailed in the advisory, so the risk remains theoretical but notable.