The vulnerability arises from insufficient permission checks within the Settings module of Huawei EMUI and HarmonyOS, allowing an attacker to access or modify protected system information. A successful exploitation can compromise the confidentiality of services, potentially revealing sensitive configuration or user data. The weakness is a classic permission control flaw as categorized by CWE-264.

Affected products are Huawei EMUI and Huawei HarmonyOS. No specific version ranges are provided in the CVE report, so all releases of the listed products are considered potentially impacted until a vendor update is released.

The CVSS score of 4.8 indicates medium impact, with no EPSS score available. The vulnerability is not listed in CISA KEV, suggesting no known exploitation or high risk. Attackers would likely need local access to the device and the ability to invoke the Settings API to abuse the permission mis‑check, so the likelihood of exploitation depends on the attacker’s physical or privileged access to the target device. Based on the description, it is inferred that a local attacker with access to the Settings module would be able to exploit this flaw.