A permission control flaw exists in HarmonyOS’s security control module, classified as CWE‑840. The vulnerability can expose services to unauthorized disclosure; no impact on integrity or availability is mentioned. It is explicitly stated that successful exploitation may affect service confidentiality, but how the confidentiality breach manifests is not described in the advisory.

HUAWEI HarmonyOS devices are affected. The advisory does not specify a version range, implying that all currently released HarmonyOS versions should be considered potentially vulnerable until an official fix is made available.

The CVSS score of 5.5 indicates a moderate risk level. EPSS data is not available, so the probability of exploitation in the wild is unknown. The flaw is not listed in CISA’s KEV catalog, suggesting no known active exploitation. The attack vector is not detailed in the advisory; it is inferred that the vulnerability likely requires elevated or local privileges to modify permission settings, though this cannot be confirmed from the supplied data.