Huawei has 67 CVEs on record between 2016 and 2026. Disclosure cadence is accelerating: 15 in the last 90 days against 0 in the 90 before. The busiest recent month was December 2025 with 16. The median CVSS is 5.5 (medium). 1% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-264 (20) and CWE-362 (8). Most affected products: HarmonyOS (61), emui (2), openBMC (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 1% vs 1% corpus
- Median CVSS
- 5.5
- Publish → KEV
- —(1)
- Last 90 days
- 15 prev 0
Weakness classes
Products
- HarmonyOS 61
- emui 2
- openBMC 2
- anyoffice 1
- openUBMC 1
Worst active — by depth score
CVE-2016-3081High· 8.1Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.89CVE-2026-65198High· 8.6Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy47CVE-2026-49310High· 8.6Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.47CVE-2025-66328High· 8.4Multi-thread race condition vulnerability in the network management module46CVE-2025-66324High· 8.4Input verification vulnerability in the compression and decompression module. Impact: Successful exploitation of this vulnerability may affect app data integrity.46
Huawei vulnerabilities
CVEs affecting Huawei, newest first. Open any entry for full detail, references, and exploit status.
67 CVEsRSS
CVE-2025-58282Low· 2.8Permission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service confidentiality.
Permission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-58278Medium· 6.2Identity authentication bypass vulnerability in the Gallery app. Successful exploitation of this vulnerability may affect service confidentiality.
Identity authentication bypass vulnerability in the Gallery app. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-58277Medium· 4.0Permission verification bypass vulnerability in the Camera app. Successful exploitation of this vulnerability may affect service confidentiality.
Permission verification bypass vulnerability in the Camera app. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-54654Medium· 6.2Permission control vulnerability in the Gallery module
Permission control vulnerability in the Gallery module. Successful exploitation of this vulnerability may affect service confidentiality
CVE-2025-58297Medium· 5.9Buffer overflow vulnerability in the sensor service. Successful exploitation of this vulnerability may affect availability.
Buffer overflow vulnerability in the sensor service. Successful exploitation of this vulnerability may affect availability.
CVE-2025-58298High· 7.3Data processing error vulnerability in the package management module. Successful exploitation of this vulnerability may affect availability.
Data processing error vulnerability in the package management module. Successful exploitation of this vulnerability may affect availability.
CVE-2016-3081High· 8.1CISA KEVPoCApache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.