CVE-2023-34155
📋 TL;DR
This vulnerability allows unauthorized calling functionality on affected Huawei phones and tablets. Exploitation could disrupt device availability through denial-of-service attacks. All users of vulnerable Huawei mobile devices are affected.
💻 Affected Systems
- Huawei phones
- Huawei tablets
📦 What is this software?
Emui by Huawei
⚠️ Risk & Real-World Impact
Worst Case
Complete device unavailability through persistent denial-of-service attacks, preventing normal phone functionality.
Likely Case
Temporary service disruption or unexpected call behavior affecting device usability.
If Mitigated
Minimal impact with proper security updates applied and standard mobile security practices.
🎯 Exploit Status
Vulnerability allows unauthorized calling, suggesting some level of access or interaction is required, but specific exploitation details are not publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Huawei security updates for June 2023 or later
Vendor Advisory: https://consumer.huawei.com/en/support/bulletin/2023/6/
Restart Required: Yes
Instructions:
1. Navigate to Settings > System & updates > Software update. 2. Check for available updates. 3. Download and install any security updates. 4. Restart device when prompted.
🔧 Temporary Workarounds
Disable unnecessary calling permissions
allReview and restrict app permissions related to phone calls and telephony services
Enable enhanced security mode
allActivate Huawei's built-in security features and app verification
🧯 If You Can't Patch
- Isolate device from untrusted networks and Bluetooth connections
- Implement strict app installation policies and only use verified applications
🔍 How to Verify
Check if Vulnerable:
Check device security patch level in Settings > About phone > Build number. Compare with Huawei's June 2023 security bulletin.Check Version:
Settings > About phone > EMUI version / HarmonyOS versionVerify Fix Applied:
Verify security patch date is June 2023 or later in Settings > About phone > Security patch level.📡 Detection & Monitoring
Log Indicators:
- Unexpected call initiation logs
- Unauthorized telephony service access attempts
- Security permission violation alerts
Network Indicators:
- Unusual call patterns or unexpected outgoing calls
- Suspicious telephony service network traffic
SIEM Query:
Not applicable for consumer mobile devices; monitor for security patch compliance in MDM systems