Security Vulnerability Report
中文
CVE-2025-64312 CVSS 4.9 MEDIUM

CVE-2025-64312

Published: 2025-11-28 04:16:01
Last Modified: 2025-12-02 02:37:47

Description

Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVSS Details

CVSS Score
4.9
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Configurations (Affected Products)

cpe:2.3:o:huawei:harmonyos:5.0.1:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:o:huawei:harmonyos:5.1.0:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:o:huawei:harmonyos:6.0.0:*:*:*:*:*:*:* - VULNERABLE
华为设备(具体版本需参考华为官方安全公告)

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-64312 PoC - Permission Control Bypass in File Management Module # Note: This is a conceptual PoC based on the vulnerability description # Actual exploitation requires physical access and user interaction import os import sys def check_vulnerability(): """ Check if the system is vulnerable to CVE-2025-64312 This vulnerability allows unauthorized file access in the file management module """ print("[*] Checking for CVE-2025-64312 vulnerability...") print("[*] Target: File Management Module Permission Control") # Check if sensitive directories exist sensitive_paths = [ "/etc/huawei/confidential", "/var/huawei/secrets", "/opt/huawei/config/sensitive" ] vulnerable = False for path in sensitive_paths: if os.path.exists(path): # Check if files are accessible without proper permissions try: files = os.listdir(path) print(f"[!] Found accessible sensitive directory: {path}") print(f"[!] Contents: {files}") vulnerable = True except PermissionError: print(f"[+] Directory {path} is properly protected") if vulnerable: print("[!] System appears to be VULNERABLE to CVE-2025-64312") print("[!] Recommendation: Apply security patch from Huawei") return True else: print("[+] System does not appear to be vulnerable") return False if __name__ == "__main__": check_vulnerability()

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-64312", "sourceIdentifier": "[email protected]", "published": "2025-11-28T04:16:00.963", "lastModified": "2025-12-02T02:37:47.483", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Permission control vulnerability in the file management module.\nImpact: Successful exploitation of this vulnerability may affect service confidentiality."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 0.7, "impactScore": 4.2}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-200"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:huawei:harmonyos:5.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "738D803A-C4CE-477B-BC89-CE47351C0A84"}, {"vulnerable": true, "criteria": "cpe:2.3:o:huawei:harmonyos:5.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "E39DE6A6-CBE6-4086-93CD-113D1B3BA730"}, {"vulnerable": true, "criteria": "cpe:2.3:o:huawei:harmonyos:6.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "0EBE30DD-E146-4A6A-BE68-DEF9D4D0B2A8"}]}]}], "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2025/11/", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}