The vulnerability is a path traversal flaw in Huawei HarmonyOS’s certificate management module. It allows an attacker to navigate outside the intended directory hierarchy when managing certificates. The primary impact of a successful exploit is a denial of service, potentially disrupting the functionality of the certificate module and thereby affecting broader system availability. The weakness is classified as CWE‑22 (Path Traversal) and CWE‑24 (Absolute Path Traversal).

Huawei HarmonyOS 5.1.0 and HarmonyOS 6.0.0 are affected. The flaw exists in the certificate management component of these operating system releases, which is responsible for handling user and system certificates.

The CVSS score is 5.9, indicating a moderate severity. The EPSS score is less than 1 %, reflecting a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely local or remote with prior authentication, as the certificate management module is typically accessed via the system interface; however, the exact vector is not explicitly documented and is inferred from the nature of the flaw.