CVE-2024-51519

Improper Input Validation (CWE-20)

Published: Nov 5, 2024 / Updated: 14d ago

010
CVSS 5.5EPSS 0.04%Medium
CVE info copied to clipboard

Summary

A vulnerability exists in the HDC module where input parameters are not being verified. This affects HarmonyOS version 5.0.0.

Impact

Successful exploitation of this vulnerability may affect the availability of the system. The CVSS v3.1 base score is 5.5, indicating a medium severity. The attack vector is local, requiring low privileges and no user interaction. While there is no impact on confidentiality or integrity, the availability impact is high.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. Huawei has released a security bulletin on November 6, 2024, which can be found at https://consumer.huawei.com/en/support/bulletin/2024/11/

Mitigation

1. Apply the patch provided by Huawei as soon as possible. 2. Limit local access to the affected systems to trusted users only. 3. Monitor for any unusual activity or degradation in system availability. 4. Implement input validation mechanisms if possible to compensate for the vulnerability until patching is complete.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Timeline

First Article

Feedly found the first article mentioning CVE-2024-51519. See article

Nov 5, 2024 at 8:32 AM / <object object at 0x79b19ecc4180>
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Nov 5, 2024 at 9:35 AM
CVE Assignment

NVD published the first details for CVE-2024-51519

Nov 5, 2024 at 10:21 AM
CVSS

A CVSS base score of 5 has been assigned.

Nov 5, 2024 at 10:26 AM / nvd
EPSS

EPSS Score was set to: 0.04% (Percentile: 10%)

Nov 6, 2024 at 11:56 AM
CVSS

A CVSS base score of 5.5 has been assigned.

Nov 6, 2024 at 11:20 PM / nvd
Static CVE Timeline Graph

Affected Systems

Huawei/harmonyos
+null more

Patches

consumer.huawei.com
+null more

Links to Mitre Att&cks

T1562.003: Impair Command History Logging
+null more

Attack Patterns

CAPEC-10: Buffer Overflow via Environment Variables
+null more

CVSS V3.1

Attack Vector:Local
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Unchanged
Confidentiality:None
Integrity:None
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI