CVE-2023-44116

CRITICAL

HarmonyOS - Missing Authentication for Critical Function in APPWidget Module

Title source: llm
STIX 2.1

Description

Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this vulnerability may cause some apps to run without being authorized.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0007
EPSS Percentile 22.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-306
Status published
Products (10)
huawei/emui 11.0.1
huawei/emui 12.0.0
huawei/emui 12.0.1
huawei/emui 13.0.0
huawei/harmonyos 2.0.0
huawei/harmonyos 2.0.1
huawei/harmonyos 2.1.0
huawei/harmonyos 3.0.0
huawei/harmonyos 3.1.0
huawei/harmonyos 4.0.0
Published Oct 11, 2023
Tracked Since Feb 18, 2026