Cyber Resilience

CVE-2025-54606

Huawei Harmonyos 5.0.1 … 5.0.2

Published
06 August 2025
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 7.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
EPSS Score 0.0010 1th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-54606 is a high-severity an unspecified weakness vulnerability in Huawei Harmonyos. Its CVSS base score is 7.3 (High).

Operationally, ranked at the 1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-11 (Device Lock) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Status verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.

CWE(s)
CWE-840NVD-CWE-noinfo

Related Threats

CVEs Like This One

CVE-2024-51523Same product: Huawei Harmonyos
CVE-2024-58046Same product: Huawei Harmonyos
CVE-2025-68958Same product: Huawei Harmonyos
CVE-2025-53184Same product: Huawei Harmonyos
CVE-2024-54113Same product: Huawei Harmonyos
CVE-2025-68967Same product: Huawei Harmonyos
CVE-2023-44107Same product: Huawei Harmonyos
CVE-2024-54103Same product: Huawei Harmonyos
CVE-2023-34154Same product: Huawei Harmonyos
CVE-2025-68955Same product: Huawei Harmonyos

Affected Assets

huawei
harmonyos
5.0.1, 5.0.2

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-11 Device Lock
  • AC-3 Access Enforcement
  • IA-2 Identification and Authentication (Organizational Users)
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-11 Device Lock good match
prevent

Directly implements device lock screen behavior whose status verification is the vulnerable component.

AC-3 Access Enforcement good match
prevent

Enforces the access decision that the flawed lock-screen status check is intended to protect.

IA-2 Identification and Authentication (Organizational Users) partial match
prevent

Requires successful identification and authentication before the lock screen grants access, mitigating the verification flaw.

References