CVE-2024-58043
Published: 04 March 2025
Summary
CVE-2024-58043 is a high-severity an unspecified weakness vulnerability in Huawei Harmonyos. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces approved authorizations for access to system resources, preventing unauthorized access and modification due to the permission bypass in the window module.
Applies least privilege to limit the scope and impact of unauthorized actions enabled by the permission bypass vulnerability.
Mandates identification, reporting, and correction of the specific permission bypass flaw, including application of vendor-provided patches.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local permission bypass vulnerability with no privileges required enables exploitation of software flaws to gain unauthorized access and modification, directly mapping to Exploitation for Privilege Escalation.
NVD Description
Permission bypass vulnerability in the window module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Deeper analysisAI
CVE-2024-58043 is a permission bypass vulnerability in the window module, published on 2025-03-04. It carries a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) and is associated with CWE-840 and NVD-CWE-noinfo. Successful exploitation may affect service confidentiality.
A local attacker with no privileges required can exploit this vulnerability with low complexity and no user interaction. Exploitation allows limited impact to confidentiality, high impact to integrity, and limited impact to availability, enabling unauthorized access or modification beyond intended permissions in the affected window module.
The Huawei consumer support bulletin at https://consumer.huawei.com/en/support/bulletin/2025/3/ provides details on mitigation and patches.
Details
- CWE(s)