CVE-2024-58044
Published: 04 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2024-58044 is a permission verification bypass vulnerability in the notification module, with a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is associated with CWE-20 (Improper Input Validation) and CWE-276 (Incorrect Default Permissions). The vulnerability affects Huawei consumer products, as detailed in the vendor's security bulletin.
A local attacker can exploit this vulnerability with low complexity and no required privileges or user interaction. Successful exploitation allows the attacker to bypass permission checks in the notification module, potentially achieving high impacts on confidentiality, integrity, and availability.
The Huawei security bulletin at https://consumer.huawei.com/en/support/bulletin/2025/3/ provides details on affected products and recommended mitigations or patches.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The local permission verification bypass (no privileges required) directly enables exploitation for privilege escalation, allowing high impacts on confidentiality, integrity, and availability by circumventing access controls in the notification module.