CVE-2024-51513
Improper Input Validation (CWE-20)
Summary
A vulnerability has been identified in the VPN module where processes are not being fully terminated. This issue affects HarmonyOS version 5.0.0.
Impact
Successful exploitation of this vulnerability will affect power consumption. The CVSS v3.1 base score is 5.5, indicating a medium severity. The attack vector is local, requiring low privileges and no user interaction. While there is no impact on confidentiality or integrity, the availability impact is high. This suggests that the main consequence of the vulnerability is increased power consumption, which could potentially lead to device battery drain or overheating.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Huawei has released a security bulletin on November 7, 2024, which can be found at https://consumer.huawei.com/en/support/bulletin/2024/11/.
Mitigation
1. Apply the patch provided by Huawei as soon as possible. 2. Monitor and manage local access to affected devices, as the attack vector is local. 3. Keep the VPN module and HarmonyOS updated to the latest version. 4. Implement the principle of least privilege to minimize the potential for exploitation. 5. Monitor affected devices for unusual power consumption patterns that may indicate exploitation.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Timeline
Feedly found the first article mentioning CVE-2024-51513. See article
Feedly estimated the CVSS score as HIGH
Feedly estimated the CVSS score as MEDIUM
NVD published the first details for CVE-2024-51513
A CVSS base score of 5.5 has been assigned.
EPSS Score was set to: 0.04% (Percentile: 10%)