The vulnerability is an authentication bypass in HarmonyOS’s device authentication module. An attacker who exploits this flaw can gain unauthorized access to the device’s internal functions, potentially leading to unauthorized data modification or leakage. The only stated consequences are loss of integrity and confidentiality, with no mention of denial of service or code execution.

Huawei HarmonyOS versions 5.1.0 and 6.0.0 are impacted, as indicated by the vendor’s official advisory and the associated Common Platform enumeration strings.

The CVSS score of 9.6 signals a severe vulnerability. The EPSS score indicates a very low exploitation probability (<1%), and the vulnerability has not been catalogued by CISA. The attack vector is not explicitly disclosed, but the flaw resides in the device authentication layer, implying that an adversary would need to interact with the device—potentially over local or remote interfaces—to gain the bypass.