CVE-2023-4566 is a high severity (CVSS 7.5) flaw in Huawei EMUI and HarmonyOS, where trust relationships can be inaccurate in distributed scenarios. Successful exploitation may affect service confidentiality. Install the Huawei security update from the January 2024 bulletin on affected devices.
What's affected
The NVD record describes a vulnerability of trust relationships being inaccurate in distributed scenarios, with an impact on service confidentiality. It lists Huawei EMUI and HarmonyOS as the affected products.
The Huawei consumer security bulletin for January 2024 lists the issue with severity High and names EMUI 13.0.0 as the affected version. The record also lists HarmonyOS, and the HarmonyOS security bulletin for the same month is linked. We did not read that second page in detail, so check it for the HarmonyOS versions that apply to your devices.
The information is brief by design. Huawei describes the class of problem and its impact, but not the mechanism, so this post cannot add detail beyond that.
How to check if you're exposed
On a Huawei device, open Settings, then About phone, and read the EMUI or HarmonyOS version and the security patch level.
Compare the patch level with the one in the January 2024 bulletin. A device at or after that patch level should include the fix, but the bulletin is the source of truth for your model.
If you manage a fleet through mobile device management, query the OS version and patch level for all Huawei devices and report those below the target.
Also check whether devices use distributed features, such as multi device collaboration, since the issue is tied to distributed scenarios.
What to do now
- Find Huawei EMUI and HarmonyOS devices in your fleet or among employees that use their own phones for work.
- Install the update that carries the January 2024 security patch level or later.
- Check the Huawei and HarmonyOS bulletins for any model that is out of support.
- Where a device cannot be updated, restrict it from handling sensitive company data.
- Review which distributed or multi device features are enabled and turn off unneeded ones.
Why it matters
The record maps this to CWE-290, which NVD labels as an authentication bypass by spoofing, and Huawei describes it as trust relationships being inaccurate in distributed scenarios. In general terms, a device that believes it is talking to a trusted peer when it is not can hand over information it should not.
Mobile operating system updates depend on the vendor and on the device model, so the practical risk is a long tail of devices that stay unpatched. The record does not claim exploitation and the CVE is not in the CISA KEV catalog. Track patch levels as a standing metric for any phones that touch company data.
Quick check
Which versions are affected?
The Huawei January 2024 bulletin names EMUI 13.0.0. The record also lists HarmonyOS, so check the HarmonyOS bulletin for the versions that apply.
Sources
Last reviewed: 19 October 2026.
