CVE-2024-57962
Published: 06 February 2025
Summary
CVE-2024-57962 is a medium-severity an unspecified weakness vulnerability in Huawei Harmonyos. Its CVSS base score is 6.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 27.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-17 (Remote Access).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the incomplete verification flaw in the VPN service module through timely identification, reporting, and patching as specified in the vendor bulletin.
Establishes usage restrictions, authentication, and protection for remote access mechanisms like the VPN service module to mitigate local exploitation risks.
Ensures receipt and implementation of security advisories, such as the Huawei bulletin detailing this VPN vulnerability, to enable proactive mitigation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local exploitation of incomplete verification in VPN service module enables application-level DoS leading to high availability impact.
NVD Description
Vulnerability of incomplete verification information in the VPN service module Impact: Successful exploitation of this vulnerability may affect availability.
Deeper analysisAI
CVE-2024-57962 is a vulnerability involving incomplete verification information in the VPN service module. It affects Huawei consumer products, as detailed in the vendor's support bulletin, and was published on 2025-02-06. The issue is rated at a CVSS v3.1 base score of 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) and is linked to CWE-701, with successful exploitation potentially impacting availability.
A local attacker with no privileges required can exploit this vulnerability through low-complexity attacks that necessitate user interaction. Upon success, the attacker can achieve high impact on availability and low impact on integrity, with no confidentiality impact.
Huawei has issued a support bulletin at https://consumer.huawei.com/en/support/bulletin/2025/2/ addressing this vulnerability, which provides information on mitigations or patches for affected products.
Details
- CWE(s)