Technical impact
A permission bypass flaw exists in the Location-Based Services (LBS) module of Huawei products. The vulnerability enables an attacker to gain access to privileged functions or data that should be restricted. As a result, the attacker can potentially affect system availability by continuing to consume resources or triggering service disruptions. The weakness is classified as CWE‑270, indicating improper authorization control.
Affected Systems
The flaw impacts Huawei EMUI firmware and HarmonyOS operating systems. Specific version information is not listed; therefore, all current releases may be affected until a vendor patch is released.
Risk and Exploitability
The CVSS score of 7.7 places this vulnerability in the high‑severity range. EPSS data is unavailable, and the flaw is not yet reported in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is inferred to be local or remote if an attacker can trigger the LBS component, such as through a crafted request or malicious application. Given the high impact on availability and the absence of existing public exploits, organizations should treat this as a high‑risk issue.
