A permission control weakness exists within the device key management module, which can allow an attacker to exploit inadequate access checks. The flaw is classified as CWE‑264, indicating insufficient authorization safeguards that could lead to improper use of cryptographic keys. If successfully exploited, the vulnerability may compromise the system’s ability to manage keys, potentially resulting in service disruption or denial of key-based authentication. No additional impact to confidentiality or integrity is described in the text.

Huawei HarmonyOS devices are affected, though specific firmware or OS versions are not enumerated in the advisory. The vulnerability is tied to the key management component of the operating system and applies to all HarmonyOS platforms that include this module.

The CVSS score of 6.2 indicates a moderate severity level, with availability as the primary impact. An EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is currently unlikely. The attack vector is not explicitly defined in the advisory; however, based on the nature of permission control flaws in key management, it is inferred that the attack would require either local access or a privilege elevation to manipulate or bypass permission checks. The lack of a publicly disclosed exploit further reduces the immediacy of risk, but the potential for service disruption warrants monitoring and remediation as soon as possible.