CVE-2025-1532 is a high severity code injection flaw in the Phoneservice module on HONOR devices. NVD scores it 8.1, and the vendor says exploitation may affect the confidentiality and integrity of the service. Read HONOR's security advisory for affected devices and update to the fixed software it lists.
What's affected
The record lists the Phoneservice module from HONOR and gives no version list. The record's description is short: the module is affected by a code injection vulnerability, and successful exploitation may affect service confidentiality and integrity. HONOR publishes the advisory at https://www.honor.com/global/security/cve-2025-1532/. The page we fetched did not give us the device and version table in readable form, so we are not listing models or fixed builds here. Use the vendor page for those details.
How to check if you're exposed
Because the record names no versions, the vendor advisory is the source of truth. Work through it in this order.
-
Open the advisory on the HONOR site and note the device models and software versions it lists.
-
On the phone, open Settings, then About phone, and note the model and software version. If you manage a fleet, export the same data from your mobile device management tool.
-
Compare the two. If your model and version appear in the affected list, apply the update that the advisory names.
The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) shows a network attack with user interaction required and no account needed, so staff behaviour such as opening a link plays a part.
What to do now
- Read the HONOR advisory and write down the affected models and fixed software versions.
- Check the model and software version on each HONOR device in use, or pull the list from your device management tool.
- Install the system update the advisory names. If no update is available for a model, ask HONOR support and consider limiting that device's use for sensitive work.
- Remind users not to follow unexpected links or install apps from outside the official store.
- Record the result in your asset inventory so the check can be repeated for the next advisory.
Why it matters
The weakness is CWE-94, code injection: an application builds or runs code from input that it should have treated as data. Details of the specific path are not in the record, and we will not guess at them.
What the record does tell us is the effect. Confidentiality and integrity are rated high and availability is not affected, which fits an attack that can read and alter data handled by the service. It is not on the CISA KEV list, and the record says nothing about use in the wild.
For fleet owners the lesson is simple. A module that ships with the phone is outside any app store update, so system updates are the fix path. Keep an eye on the update level of devices that receive company data.
Quick check
Which HONOR models are affected?
The record does not list models. Check the vendor advisory for the current table, since it is the authority on device and version details.
Do I need to do anything if I have no HONOR phones?
No. If you have none, there is nothing to patch, but check whether staff use personal HONOR devices to reach company email or files.
Sources
- Safeguard Gold record for CVE-2025-1532
- NVD entry for CVE-2025-1532
- Fetched reference on www.honor.com
Last reviewed: 19 October 2026.
