This vulnerability stems from a permission control flaw in the HarmonyOS app management and control module. The flaw may allow an attacker to obtain unintended access to confidential system or application data, as the module does not properly enforce the intended access controls, consistent with the CWE‑264 weakness. The CVSS score of 3.6 indicates a low rate of severity, suggesting that the impact is limited to confidentiality rather than broader availability or integrity issues. The precise exploitation details are not disclosed, so it is inferred that the attacker could abuse the permission checks to gain unauthorized access.

The affected systems are devices running Huawei HarmonyOS that include the app management and control module. No specific version identifiers are provided in the data, so any device currently deploying the module could be vulnerable until a vendor patch is released.

With no EPSS score available and the vulnerability not listed in CISA’s KEV catalog, the likelihood of already observed exploitation is low. The exploitation path likely requires an attacker to bypass local permission checks or achieve a privileged role within the operating system; this scenario is inferred from the description since the details are not specified. Given the low CVSS score, the risk is considered moderate, and monitoring for new dissemination of tags or exploits is advised.