CVE-2025-46014
Published: 30 June 2025
Summary
CVE-2025-46014 is a high-severity Incorrect Default Permissions (CWE-276) vulnerability in Honor Pc Manager. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 47.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-19506
Vulnerability details
Several services in Honor Device Co., Ltd Honor PC Manager v16.0.0.118 was discovered to connect services to the named pipe iMateBookAssistant with default or overly permissive security attributes, leading to a privilege escalation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a privilege escalation vulnerability due to services in Honor PC Manager connecting to a named pipe with default or overly permissive security attributes, directly enabling exploitation for privilege escalation (T1068).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
The access control policy and procedures directly mandate and enforce proper access control mechanisms across the organization.
Guides setting of default permissions to the minimum required level.
Defines roles, responsibilities, and access rules for configuration management activities, making improper access to configuration resources harder to exploit.
Baseline includes documented access control settings that are reviewed and maintained, reducing the ability to exploit improper access control.
Requiring the most restrictive settings instead of defaults prevents incorrect default permissions on resources.
Explicitly requires protecting the configuration management plan from unauthorized disclosure and modification.
The policy defines and enforces restrictions on physical access to resources, directly reducing improper access control.
Tailoring explicitly overrides or scopes default permission assignments in the baseline to match the system's actual risk and operational needs.