CVE-2023-52360
Huawei Harmonyos 2.0.0 … 4.0.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-52360 is a high-severity Logic/Time Bomb (CWE-511) vulnerability in Huawei Harmonyos. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-7 (Software, Firmware, and Information Integrity) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-57016
Vulnerability Data
Logic vulnerabilities in the baseband.Successful exploitation of this vulnerability may affect service integrity.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover hidden time- or logic-triggered code before deployment.
Integrity verification tools detect unauthorized code insertions that implement logic or time bombs.
Configuration change control and approval gates reduce the chance of covert malicious code being added.
Developer configuration management enforces controlled, auditable changes that hinder hidden bomb insertion.
Requires documented development standards and tools that can structurally exclude insertion of triggered malicious logic.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Event analysis helps understand bomb-triggered disruption after it occurs.
Runtime monitoring of software and data can detect activation of time/logic conditions.
Secure development practices directly reduce insertion of intentional trigger logic during coding.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Logging can record execution of time- or logic-triggered code, aiding detection after the fact.
Monitoring activities may detect anomalous behavior triggered by a logic/time bomb.
Secure development lifecycle processes include code review and testing that detect logic/time bombs before deployment.