The vulnerability is an improper criterion security check in the card module of Huawei HarmonyOS. This flaw can lead to the unauthorized disclosure of service data and could allow an attacker to gain access to sensitive information managed by the card module. The weakness corresponds to improper access control and permission handling. It is a moderate security flaw, with a CVSS score of 5.9, and it threatens the confidentiality of the services that rely on the card module.

Huawei HarmonyOS versions 5.1.0 and 6.0.0 are affected. The vulnerability was identified as affecting the card module present in these releases.

The CVSS score of 5.9 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation is unlikely, and the vulnerability is not listed in the CISA KEV catalog. Likely, the attack vector involves interaction with the card module through local user actions or integration with services that use the module. Based on the description, it is inferred that the flaw requires an attacker to invoke the card module functions, but no remote direct exploitation is explicitly described. The primary risk is confidentiality loss rather than denial of service or privilege escalation.