Cyber Posture

CVE-2025-23414

Low

Published: 04 March 2025

Published
04 March 2025
Modified
04 March 2025
KEV Added
Patch
CVSS Score 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
EPSS Score 0.0012 30.1th percentile
Risk Priority 8 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

Security Summary

CVE-2025-23414 is a use-after-free vulnerability (CWE-416) in OpenHarmony versions v5.0.2 and prior. Published on 2025-03-04T04:15:15.377, it enables a local attacker to achieve arbitrary code execution within pre-installed applications. The vulnerability carries a CVSS v3.1 base score of 3.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N), reflecting low severity with local access requirements, low attack complexity, low privileges needed, no user interaction, changed scope, and limited confidentiality impact.

A local attacker with low privileges can exploit this vulnerability to execute arbitrary code in pre-installed apps. Exploitation is possible only in restricted scenarios, requiring physical or logical local access to the system. While it grants code execution, impacts are confined to low confidentiality disclosure with no integrity or availability effects.

The OpenHarmony security advisory provides further details on this vulnerability at https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md.

Details

CWE(s)
CWE-416

Affected Products

openatom
openharmony
4.1.0 — 5.0.2

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

The use-after-free vulnerability in pre-installed applications allows a local attacker with low privileges to achieve arbitrary code execution, directly enabling exploitation for privilege escalation (T1068) as the attacker starts with low privileges and gains code execution in system-level apps.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References