Technical impact
A race condition exists in Huawei HarmonyOS’s device security management module. When multiple processes access shared resources without proper synchronization, the module may enter an inconsistent state, potentially causing it to become hang or unresponsive. Successful exploitation of this flaw can result in a denial‑of‑service condition for device security services, thereby affecting overall system availability. The underlying weakness is identified as CWE‑362.
Affected Systems
Huawei HarmonyOS versions 5.1.0 and 6.0.0 are affected by the race condition in their device security management module.
Risk and Exploitability
The CVSS base score of 4.7 places this vulnerability in the medium severity range, indicating that it can disrupt service availability but is not catastrophic. An EPSS score of less than one percent indicates the likelihood of exploitation in the immediate future is low, and the vulnerability is not listed in the CISA KEV catalog. Because the vulnerability description does not specify a remote vector, it is inferred that the attack likely requires local or privileged access to the device security management component. Overall, the risk is moderate, with low probability but potential for denial of service if local or privileged access is available.
