The vulnerability involves improper handling of data within Huawei HarmonyOS’s certificate management module. If successfully exploited, it could compromise the confidentiality of services that rely on certificate processing, potentially exposing sensitive information managed by the system. No claim is made that an attacker can arbitrarily tamper with certificate data.

The flaw affects Huawei HarmonyOS releases 5.1.0 and 6.0.0, as identified by the listed CPE entries. No other product families or builds are indicated as impacted.

The CVSS score of 6.2 indicates medium severity, while the EPSS score of < 1% indicates a very low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, implying it has not been observed in large‑scale attacks. The attack vector is not explicitly described; it is inferred that a process or user capable of supplying custom data to the certificate management module could trigger the issue, possibly requiring elevated privileges or local system access. The overall risk profile therefore centers on specialized attackers who can influence certificate‑related data handling to compromise confidentiality.