Login Sign Up

CVE-2021-40006

4.6 MEDIUM

📋 TL;DR

CVE-2021-40006 is a security algorithm design defect vulnerability affecting Huawei HarmonyOS and EMUI devices. Successful exploitation could allow attackers to compromise data confidentiality. This affects Huawei smartphones, tablets, and other devices running vulnerable HarmonyOS/EMUI versions.

💻 Affected Systems

Products:
  • Huawei smartphones
  • Huawei tablets
  • Huawei devices running HarmonyOS/EMUI
Versions: HarmonyOS 2.0, 2.1, 3.0, 3.1; EMUI 12.0, 12.1 (specific affected versions detailed in Huawei advisories)
Operating Systems: HarmonyOS, EMUI
Default Config Vulnerable: ⚠️ Yes
Notes: Affects devices with the vulnerable security algorithm component. Exact device models and configurations should be verified against Huawei security bulletins.

📦 What is this software?

Harmonyos by Huawei

View all CVEs affecting Harmonyos →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could decrypt sensitive data or bypass security protections, potentially exposing user data, authentication credentials, or encrypted communications.

🟠

Likely Case

Targeted attacks against specific devices to extract limited sensitive information or weaken security controls.

🟢

If Mitigated

With proper patching and security controls, impact is minimal as the vulnerability requires specific conditions and access to exploit.

🌐 Internet-Facing: LOW - This vulnerability primarily affects device-level security rather than internet-facing services.
🏢 Internal Only: MEDIUM - Could be exploited in targeted attacks against specific devices within an organization.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: HIGH

Exploitation requires specific conditions and knowledge of the security algorithm implementation. No public exploits have been reported.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: HarmonyOS 2.0.0.230(C00E230R8P2) and later; EMUI 12.0.0.230(C00E230R8P2) and later (check specific device advisories)

Vendor Advisory: https://consumer.huawei.com/en/support/bulletin/2023/8/

Restart Required: Yes

Instructions:

1. Check for system updates in device Settings > System & updates > Software update. 2. Download and install available security updates. 3. Restart device after installation completes.

🔧 Temporary Workarounds

Disable unnecessary features

all

Reduce attack surface by disabling unused device features and services

Enhanced monitoring

all

Implement device security monitoring and anomaly detection

🧯 If You Can't Patch

  • Isolate affected devices from sensitive networks and data
  • Implement additional encryption layers for sensitive data on affected devices

🔍 How to Verify

Check if Vulnerable:

Check device Settings > About phone > HarmonyOS/EMUI version. Compare against vulnerable versions listed in Huawei security bulletins.

Check Version:

Settings > About phone > HarmonyOS version / EMUI version

Verify Fix Applied:

Verify installed version is equal to or newer than patched versions in Huawei advisories. Check last security update date in Settings > System & updates.

📡 Detection & Monitoring

Log Indicators:

  • Unusual security algorithm errors
  • Unexpected cryptographic operations
  • Security service anomalies

Network Indicators:

  • Unusual encrypted traffic patterns from affected devices
  • Anomalous security protocol negotiations

SIEM Query:

device.os:HarmonyOS OR device.os:EMUI AND security.algorithm.error OR cryptographic.exception

📊 Metadata

CVE ID: CVE-2021-40006
CVSS v3 Score: 4.6 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE: CWE-254
Published: January 10, 2022
Last Updated: February 24, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON