CVE-2023-0036

MEDIUM

OpenHarmony 3.0-3.0.5 - Authentication Bypass via platform_callback_stub

Title source: llm

Description

platform_callback_stub in misc subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA relay attack".Local attackers can bypass authentication and attack other SAs with high privilege.

References (1)

Core 1

Core References

Third Party Advisory

https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2023/2023-01.md

Scores

CVSS v3 6.5

EPSS 0.0018

EPSS Percentile 8.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-287 CWE-294

Status published

Products (1)

openatom/openharmony 3.0 - 3.0.5

Published Jan 09, 2023

Tracked Since Feb 18, 2026