CVE-2023-41305
📋 TL;DR
This vulnerability allows 5G SMS messages to be sent without encryption in VPN environments, potentially exposing message contents to interception. It affects Huawei devices running HarmonyOS. Attackers could read sensitive SMS content transmitted over VPN connections.
💻 Affected Systems
- Huawei smartphones and tablets with 5G capability
📦 What is this software?
Emui by Huawei
Emui by Huawei
Emui by Huawei
Emui by Huawei
Harmonyos by Huawei
Harmonyos by Huawei
Harmonyos by Huawei
Harmonyos by Huawei
Harmonyos by Huawei
⚠️ Risk & Real-World Impact
Worst Case
Sensitive SMS messages (including authentication codes, financial information, or personal communications) are intercepted and read by attackers on the same VPN network.
Likely Case
Limited exposure of non-critical SMS content when devices connect to untrusted VPNs, with most enterprise VPNs providing additional security layers.
If Mitigated
No data exposure when using patched devices or avoiding untrusted VPN networks for SMS transmission.
🎯 Exploit Status
Exploitation requires being on the same VPN network as the target device and intercepting 5G SMS packets.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: HarmonyOS security updates from September 2023 onward
Vendor Advisory: https://consumer.huawei.com/en/support/bulletin/2023/9/
Restart Required: Yes
Instructions:
1. Check for system updates in device Settings. 2. Install available HarmonyOS security updates. 3. Restart device after update completes.
🔧 Temporary Workarounds
Disable VPN for SMS
allAvoid sending SMS messages while connected to VPN networks
Manually disconnect from VPN before sending SMS
Use encrypted messaging apps
allUse end-to-end encrypted messaging applications instead of SMS for sensitive communications
🧯 If You Can't Patch
- Restrict VPN access to trusted networks only
- Implement network monitoring for SMS traffic interception attempts on VPN segments
🔍 How to Verify
Check if Vulnerable:
Check HarmonyOS version in Settings > About phone > HarmonyOS version. If version predates September 2023 security updates, device is vulnerable.Check Version:
Settings navigation only - no CLI command availableVerify Fix Applied:
Verify HarmonyOS version includes September 2023 or later security patches in Settings > Security > Security update📡 Detection & Monitoring
Log Indicators:
- Unusual SMS transmission patterns over VPN
- Failed SMS encryption attempts in system logs
Network Indicators:
- Unencrypted SMS packets on VPN interfaces
- SMS traffic without TLS/encryption headers
SIEM Query:
source="vpn_logs" AND (protocol="sms" OR port="5g_sms") AND encryption="none"🔗 References
- https://consumer.huawei.com/en/support/bulletin/2023/9/
- https://device.harmonyos.com/en/docs/security/update/security-bulletins-202309-0000001638925158
- https://consumer.huawei.com/en/support/bulletin/2023/9/
- https://device.harmonyos.com/en/docs/security/update/security-bulletins-202309-0000001638925158
