CVE-2024-54121
Published: 08 January 2025
Summary
CVE-2024-54121 is a medium-severity Improper Input Validation (CWE-20) vulnerability in Huawei Harmonyos. Its CVSS base score is 6.2 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 35.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates validation of all inputs to the ability module during startup, addressing the core CWE-20 improper input validation vulnerability.
Requires timely flaw remediation including application of Huawei patches for CVE-2024-54121 to eliminate the startup control vulnerability.
Provides denial-of-service protection mechanisms to mitigate high availability impacts from local exploitation disrupting feature operation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local improper input validation in startup/ability module directly enables application/system exploitation leading to availability DoS (high A impact, no C/I).
NVD Description
Startup control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
Deeper analysisAI
CVE-2024-54121 is a startup control vulnerability in the ability module, published on 2025-01-08 with a CVSS v3.1 base score of 6.2 (Medium). The vulnerability is associated with CWE-20 (Improper Input Validation) and is detailed in a Huawei consumer support bulletin. Successful exploitation may cause features to perform abnormally, primarily impacting availability.
The attack vector is local (AV:L) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), and resulting in unchanged scope (S:U). A local attacker can exploit this to achieve high availability impact (C:N/I:N/A:H), disrupting normal feature operation without compromising confidentiality or integrity.
Mitigation details are provided in the Huawei advisory at https://consumer.huawei.com/en/support/bulletin/2025/1/. Security practitioners should consult this bulletin for patch information and recommended actions specific to affected Huawei devices.
Details
- CWE(s)