huawei has 84 CVEs on record between 2016 and 2026. Disclosure cadence is accelerating: 32 in the last 90 days against 0 in the 90 before. The busiest recent month was November 2026 with 17. The median CVSS is 5.5 (medium). 1% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-264 (25) and CWE-200 (9). Most affected products: HarmonyOS (78), emui (2), openBMC (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 1% vs 1% corpus
- Median CVSS
- 5.5
- Publish → KEV
- —(1)
- Last 90 days
- 32 prev 0
Weakness classes
Products
- HarmonyOS 78
- emui 2
- openBMC 2
- anyoffice 1
- openUBMC 1
Worst active — by depth score
CVE-2016-3081High· 8.1Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.89CVE-2026-65198High· 8.6Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy47CVE-2026-49310High· 8.6Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.47CVE-2025-66328High· 8.4Multi-thread race condition vulnerability in the network management module46CVE-2025-66324High· 8.4Input verification vulnerability in the compression and decompression module. Impact: Successful exploitation of this vulnerability may affect app data integrity.46
huawei vulnerabilities
CVEs affecting huawei, newest first. Open any entry for full detail, references, and exploit status.
84 CVEsRSS
CVE-2025-58316High· 7.3DoS vulnerability in the video-related system service module. Impact: Successful exploitation of this vulnerability may affect availability.
DoS vulnerability in the video-related system service module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2025-58312Medium· 5.1Permission control vulnerability in the App Lock module. Impact: Successful exploitation of this vulnerability may affect availability.
Permission control vulnerability in the App Lock module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2025-58301Medium· 6.2Buffer overflow vulnerability in the device management module. Successful exploitation of this vulnerability may affect availability.
Buffer overflow vulnerability in the device management module. Successful exploitation of this vulnerability may affect availability.
CVE-2025-58300Medium· 6.2Buffer overflow vulnerability in the device management module. Successful exploitation of this vulnerability may affect availability.
Buffer overflow vulnerability in the device management module. Successful exploitation of this vulnerability may affect availability.
CVE-2025-58293Medium· 5.5Vulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability.
Vulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability.
CVE-2025-58289Medium· 5.9Vulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability.
Vulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability.
CVE-2025-58299High· 8.4Use After Free (UAF) vulnerability in the storage management module. Successful exploitation of this vulnerability may affect availability.
Use After Free (UAF) vulnerability in the storage management module. Successful exploitation of this vulnerability may affect availability.
CVE-2025-58295Medium· 5.9Buffer overflow vulnerability in the development framework module. Successful exploitation of this vulnerability may affect availability.
Buffer overflow vulnerability in the development framework module. Successful exploitation of this vulnerability may affect availability.
CVE-2025-58292Low· 3.3Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
CVE-2025-58291Low· 3.3Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
CVE-2025-58290Low· 3.3Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
CVE-2025-58288Medium· 5.5Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
CVE-2025-58287High· 7.8Use After Free (UAF) vulnerability in the office service. Successful exploitation of this vulnerability may affect service confidentiality.
Use After Free (UAF) vulnerability in the office service. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-58286Low· 3.3Denial of service (DoS) vulnerability in the office service
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
CVE-2025-58285Medium· 5.3Permission control vulnerability in the media module. Successful exploitation of this vulnerability may affect service confidentiality.
Permission control vulnerability in the media module. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-58284Medium· 5.9Permission control vulnerability in the network module. Successful exploitation of this vulnerability may affect service confidentiality.
Permission control vulnerability in the network module. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-58283Medium· 5.5Permission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service confidentiality.
Permission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-58282Low· 2.8Permission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service confidentiality.
Permission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-58278Medium· 6.2Identity authentication bypass vulnerability in the Gallery app. Successful exploitation of this vulnerability may affect service confidentiality.
Identity authentication bypass vulnerability in the Gallery app. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-58277Medium· 4.0Permission verification bypass vulnerability in the Camera app. Successful exploitation of this vulnerability may affect service confidentiality.
Permission verification bypass vulnerability in the Camera app. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-54654Medium· 6.2Permission control vulnerability in the Gallery module
Permission control vulnerability in the Gallery module. Successful exploitation of this vulnerability may affect service confidentiality
CVE-2025-58297Medium· 5.9Buffer overflow vulnerability in the sensor service. Successful exploitation of this vulnerability may affect availability.
Buffer overflow vulnerability in the sensor service. Successful exploitation of this vulnerability may affect availability.
CVE-2025-58298High· 7.3Data processing error vulnerability in the package management module. Successful exploitation of this vulnerability may affect availability.
Data processing error vulnerability in the package management module. Successful exploitation of this vulnerability may affect availability.
CVE-2016-3081High· 8.1CISA KEVPoCApache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.