CVE-2026-28553
Huawei Harmonyos 4.0.0 … 4.3.1
Raw vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:LSummary
CVE-2026-28553 is a medium-severity an unspecified weakness vulnerability in Huawei Harmonyos. Its CVSS base score is 6.9 (Medium).
Operationally, ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-28553 is a vulnerability involving improper permission control in the theme setting module, associated with CWE-275. It affects Huawei consumer products, as indicated by the vendor's support bulletin. Published on 2026-04-13, the issue carries a CVSS v3.1 base score of 6.9 (AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L), highlighting a medium-severity risk primarily to confidentiality.
Exploitation requires local access, high attack complexity, no privileges, and user interaction. A local attacker could leverage this to achieve high confidentiality impact, along with low integrity and availability impacts, due to the changed scope. Successful exploitation may compromise service confidentiality.
Huawei has issued a support bulletin at https://consumer.huawei.com/en/support/bulletin/2026/4/, which provides details on the vulnerability and likely includes mitigation guidance or patches for affected products.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21791
Vulnerability Data
Vulnerability of improper permission control in the theme setting module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.