Improper Input Validation (CWE-20)
A vulnerability exists in the WantAgent module where the parameter type is not being verified. This is an instance of improper input validation.
Successful exploitation of this vulnerability may affect the availability of the system. The attack vector is local, requiring low privileges and no user interaction. The impact is limited to availability, with no effect on confidentiality or integrity.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available. Huawei has released a security bulletin on November 7, 2024, which can be accessed at https://consumer.huawei.com/en/support/bulletin/2024/11/
Update to the latest version of HarmonyOS as provided in the Huawei security bulletin. Implement input validation mechanisms to ensure proper verification of parameter types in the WantAgent module. Restrict local access and enforce principle of least privilege to minimize the risk of exploitation.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Feedly found the first article mentioning CVE-2024-51511. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-51511
A CVSS base score of 6.2 has been assigned.
Feedly estimated the CVSS score as MEDIUM
EPSS Score was set to: 0.04% (Percentile: 10%)
A CVSS base score of 5.5 has been assigned.