CVE-2025-23420
Published: 04 March 2025
Summary
CVE-2025-23420 is a low-severity Out-of-bounds Write (CWE-787) vulnerability in Openatom Openharmony. Its CVSS base score is 3.8 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 28.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-23420, published on 2025-03-04, is an out-of-bounds write vulnerability (CWE-787) affecting OpenHarmony versions 5.0.2 and prior. It enables a local attacker to execute arbitrary code within pre-installed applications.
The vulnerability carries a CVSS v3.1 base score of 3.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N). A local attacker with low privileges can exploit it under low complexity conditions without user interaction, achieving arbitrary code execution in pre-installed apps, though only in restricted scenarios. The changed scope reflects potential impact across security boundaries with low confidentiality effects.
For details on mitigation, patches, or workarounds, refer to the OpenHarmony security disclosure advisory at https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7640
Vulnerability details
in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local out-of-bounds write enabling arbitrary code execution in pre-installed applications by a low-privileged local attacker directly maps to exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the out-of-bounds write vulnerability in OpenHarmony pre-installed apps by applying vendor-provided patches.
Implements memory protection mechanisms like address space randomization and data execution prevention to block exploitation of out-of-bounds writes leading to arbitrary code execution.
Confines arbitrary code execution within the exploited pre-installed app process, limiting scope change and cross-process impacts as indicated by the CVE's CVSS score.