CVE-2024-58127 is a high severity (CVSS 8.4) access control vulnerability in the security verification module of Huawei HarmonyOS and EMUI. Huawei listed it in its April 2025 bulletin for phones and tablets. The advisory points to system updates, so install the latest HarmonyOS or EMUI release on every affected device.
What's affected
Huawei's April 2025 bulletin for phones and tablets lists this CVE against the following software: HarmonyOS 4.3.0, HarmonyOS 4.0.0 and EMUI 14.0.0. The NVD record names two products, Huawei EMUI and Huawei HarmonyOS, and rates the issue High.
The bulletin describes the flaw only as an access control vulnerability in the security verification module, and says that successful exploitation will affect integrity and confidentiality. It does not name a fixed version for each CVE in the row. The bulletin is a monthly security update, so the fix ships as part of the regular system update for supported models.
Several sibling CVEs share the same description and the same module: CVE-2024-58124, CVE-2024-58125 and CVE-2024-58126. If you track one of them, track them together and confirm each against the bulletin for your exact model.
How to check if you're exposed
This is a mobile operating system issue, so there is no package manager command to run. The check is about device software versions.
- Open Settings on the device, go to About phone or About tablet, and note the HarmonyOS or EMUI version and the security patch level.
- Compare that version with the affected list above and with the April 2025 bulletin.
- If you manage a fleet through mobile device management, export the OS version and patch level for every Huawei device and filter for the versions in the bulletin.
- Treat any device that cannot update, because its model is out of support, as exposed and plan to replace or isolate it.
Huawei publishes bulletins per month, so also read the later monthly bulletins. A device that is current on the latest patch should already include the April fixes.
What to do now
- Update HarmonyOS or EMUI on each affected phone and tablet to the latest release offered for the model.
- Confirm the security patch level on the device reads April 2025 or later.
- Check the bulletin for your exact device model, since Huawei does not list a fixed version per CVE.
- Retire or restrict devices that no longer receive updates, especially if they hold work data.
- Record the result in your device inventory so the next review starts from facts.
Why it matters
The advisory gives little detail beyond the module name, and that is normal for vendor mobile bulletins. What we can say from the record is the class of problem. The weakness is mapped to authentication bypass by spoofing, which means a check that is supposed to confirm who or what is asking can be fooled.
The vector says the attack is local, needs low complexity, no privileges and no user interaction, and rates confidentiality, integrity and availability impact all as high. Local means the attacker needs to run something on the device, for example through another app or physical access. That is a lower bar than a remote bug in some settings, so a high score is fair even though nothing here is reachable from the internet.
The weakness class is CWE-290: Authentication Bypass by Spoofing. The CVSS vector in the record is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 8.4. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
Is this remotely exploitable?
The CVSS vector uses a local attack vector, so the attacker needs a foothold on the device. The record does not describe a network path.
Is there a patch version I can look up?
Huawei's bulletin lists affected versions but not a fixed version per CVE. Install the latest system update and check the bulletin for your model.
Sources
Last reviewed: 19 October 2026.
