CVE-2024-57954
Published: 06 February 2025
Summary
CVE-2024-57954 is a medium-severity Improper Authorization (CWE-285) vulnerability in Huawei Harmonyos. Its CVSS base score is 6.2 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 12.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-24 (Access Control Decisions) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2024-57954 is a permission verification vulnerability in the media library module, classified under CWE-285 (Improper Authorization). Published on 2025-02-06, it carries a CVSS v3.1 base score of 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating medium severity with high impact on confidentiality but no impact on integrity or availability.
A local attacker requires no privileges, low attack complexity, and no user interaction to exploit the vulnerability. Successful exploitation allows access to confidential service data, potentially compromising sensitive information within the affected media library module.
Mitigation details are provided in the Huawei support bulletin at https://consumer.huawei.com/en/support/bulletin/2025/2/. Security practitioners should consult this advisory for patching instructions and workarounds applicable to affected Huawei products.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53856
Vulnerability details
Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local unauthorized read access to confidential media library data directly enables collection of sensitive files/information from the local system (T1005).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 mandates enforcement of approved authorizations for access to system resources, directly countering the improper permission verification in the media library module that allows unauthorized confidentiality breaches.
AC-24 requires the system to make and enforce access control decisions for specific resources, addressing the flawed permission checks exploited by local unprivileged attackers.
AC-6 enforces least privilege, limiting potential damage from improper authorization by restricting unprivileged local access to confidential media library data.