CVE-2024-57960
Published: 06 February 2025
Summary
CVE-2024-57960 is a high-severity Improper Input Validation (CWE-20) vulnerability in Huawei Harmonyos. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 10.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-57960 is an input verification vulnerability, classified under CWE-20 (Improper Input Validation), in the ExternalStorageProvider module of Huawei products. Published on 2025-02-06, it carries a CVSS v3.1 base score of 7.7 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L), indicating a high-severity issue with potential to affect service confidentiality upon successful exploitation.
The vulnerability can be exploited by a local attacker requiring no privileges (PR:N) but necessitating user interaction (UI:R), with low attack complexity (AC:L). Exploitation changes scope (S:C) and primarily enables high confidentiality impact (C:H), alongside low integrity (I:L) and availability (A:L) effects, allowing unauthorized access to sensitive service data.
Huawei has issued a consumer support bulletin addressing this vulnerability, available at https://consumer.huawei.com/en/support/bulletin/2025/2/, which provides details on mitigation and patching recommendations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53862
Vulnerability details
Input verification vulnerability in the ExternalStorageProvider module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local input validation flaw (CWE-20) in storage provider directly enables unauthorized sensitive data access (T1005) and scope-changing privilege escalation (T1068) from unprivileged context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of information inputs to the ExternalStorageProvider module, addressing the core improper input validation vulnerability (CWE-20).
Mandates timely identification, reporting, and patching of the flaw in Huawei products as per the issued consumer support bulletin.
Enforces approved access authorizations to mitigate unauthorized confidentiality access resulting from input validation exploitation.