CVE-2024-58044
Published: 04 March 2025
Summary
CVE-2024-58044 is a high-severity Improper Input Validation (CWE-20) vulnerability in Huawei Harmonyos. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
AC-3 enforces approved authorizations for logical access to information and system resources, directly preventing permission verification bypasses in the notification module.
SI-10 requires validation of inputs to ensure they are consistent with expected content, addressing the CWE-20 improper input validation that enables the permission bypass.
AC-6 enforces least privilege by authorizing access only for specific functions, limiting the impact of permission bypasses related to CWE-276 incorrect default permissions.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The local permission verification bypass (no privileges required) directly enables exploitation for privilege escalation, allowing high impacts on confidentiality, integrity, and availability by circumventing access controls in the notification module.
NVD Description
Permission verification bypass vulnerability in the notification module Impact: Successful exploitation of this vulnerability may affect availability.
Deeper analysisAI
CVE-2024-58044 is a permission verification bypass vulnerability in the notification module, with a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is associated with CWE-20 (Improper Input Validation) and CWE-276 (Incorrect Default Permissions). The vulnerability affects Huawei consumer products, as detailed in the vendor's security bulletin.
A local attacker can exploit this vulnerability with low complexity and no required privileges or user interaction. Successful exploitation allows the attacker to bypass permission checks in the notification module, potentially achieving high impacts on confidentiality, integrity, and availability.
The Huawei security bulletin at https://consumer.huawei.com/en/support/bulletin/2025/3/ provides details on affected products and recommended mitigations or patches.
Details
- CWE(s)