CVE-2021-22368
📋 TL;DR
This CVE describes a permission control vulnerability in Huawei smartphones where improper access controls allow unauthorized actions. The vulnerability affects Huawei smartphone users running specific EMUI versions. Successful exploitation could compromise device functionality and user data.
💻 Affected Systems
- Huawei smartphones
📦 What is this software?
Emui by Huawei
Magic Ui by Huawei
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing unauthorized access to sensitive data, system functions, or installation of malicious apps without user consent.
Likely Case
Unauthorized access to certain device functions or data, potentially affecting privacy and device stability.
If Mitigated
Limited impact with proper security controls and updated software, maintaining normal device operation.
🎯 Exploit Status
Exploitation likely requires local access or malicious app installation; no public exploit details available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: EMUI 11.0.1.195 (C00E195R5P5) or later
Vendor Advisory: https://consumer.huawei.com/en/support/bulletin/2021/5/
Restart Required: Yes
Instructions:
1. Check for updates in Settings > System & updates > Software update. 2. Download and install available security updates. 3. Restart device after installation completes.
🔧 Temporary Workarounds
Restrict app installations
androidOnly install apps from trusted sources like Huawei AppGallery
Settings > Security > More settings > Install apps from external sources > Disable
Review app permissions
androidRegularly audit and restrict unnecessary app permissions
Settings > Apps > [App Name] > Permissions > Review and disable unnecessary permissions
🧯 If You Can't Patch
- Disable installation from unknown sources in device security settings
- Use mobile security software to detect and block malicious applications
🔍 How to Verify
Check if Vulnerable:
Check EMUI version in Settings > About phone > EMUI version. If version is 11.0.0 or 11.0.1 (before 11.0.1.195), device is vulnerable.Check Version:
Settings > About phone > EMUI versionVerify Fix Applied:
Verify EMUI version is 11.0.1.195 (C00E195R5P5) or later in Settings > About phone > EMUI version.📡 Detection & Monitoring
Log Indicators:
- Unexpected permission requests in system logs
- Unauthorized access attempts to protected resources
Network Indicators:
- Unusual network activity from apps with minimal permissions
SIEM Query:
Not applicable for consumer mobile devices; use mobile device management (MDM) solutions for enterprise environments.