CVE-2021-37116
📋 TL;DR
CVE-2021-37116 is a design weakness vulnerability in PCManager that allows attackers to change subscriber PINs without proper authorization. This affects Huawei devices running HarmonyOS with PCManager installed. Successful exploitation compromises user authentication security.
💻 Affected Systems
- Huawei PCManager
📦 What is this software?
Harmonyos by Huawei
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover through PIN reset, enabling unauthorized access to personal data, services, and potentially device control.
Likely Case
Unauthorized PIN changes leading to account lockouts, service disruption, and potential data access if combined with other vulnerabilities.
If Mitigated
Limited impact with proper network segmentation, strong authentication controls, and monitoring for unusual PIN change activities.
🎯 Exploit Status
Exploitation likely requires some level of access or user interaction. No public exploit code available based on references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: October 2021 security updates for HarmonyOS
Vendor Advisory: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-0000001162998526
Restart Required: Yes
Instructions:
1. Check for available updates in device settings. 2. Apply October 2021 security updates. 3. Restart device. 4. Verify PCManager is updated to patched version.
🔧 Temporary Workarounds
Disable PCManager
android/harmonyosTemporarily disable PCManager service if not required
adb shell pm disable com.huawei.pcmanager
Network Restriction
allRestrict network access for PCManager to trusted networks only
🧯 If You Can't Patch
- Implement strong network segmentation to isolate affected devices
- Enable detailed logging for PIN change events and monitor for anomalies
🔍 How to Verify
Check if Vulnerable:
Check PCManager version and verify if pre-October 2021 security updatesCheck Version:
adb shell dumpsys package com.huawei.pcmanager | grep versionNameVerify Fix Applied:
Confirm October 2021 security updates are installed and PCManager version is updated📡 Detection & Monitoring
Log Indicators:
- Unexpected PIN change events
- Multiple failed PIN attempts followed by successful change
- PCManager process anomalies
Network Indicators:
- Unusual network traffic from PCManager
- Connections to unexpected endpoints
SIEM Query:
source="device_logs" AND (event="PIN_CHANGE" OR process="pcmanager") AND result="success" | stats count by user, device_id