CVE-2022-22258

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Wi-Fi module has an event notification vulnerability.Successful exploitation of this vulnerability may allow third-party applications to intercept event notifications and add information and result in elevation-of-privilege.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	HarmonyOS;EMUI;Magic UI	HarmonyOS 2.0; EMUI 12.0.0,EMUI 11.0.1,EMUI 11.0.0,EMUI 10.1.1,EMUI 10.1.0; Magic UI 4.0.0,Magic UI 3.1.1,Magic UI 3.1.0

References

https://consumer.huawei.com/en/support/bulletin/2022/4/Vendor Advisory
https://consumer.huawei.com/en/support/bulletin/2022/5/Vendor Advisory
https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202204-0000001224076294Vendor Advisory
https://consumer.huawei.com/en/support/bulletin/2022/4/Vendor Advisory
https://consumer.huawei.com/en/support/bulletin/2022/5/Vendor Advisory
https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202204-0000001224076294Vendor Advisory

Timeline

Published: Apr 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-222596.8There is an improper authentication vulnerability in FLMG-10 10.0.1.0(H100SP22C00). Successful exploitation of this vulnerability may lead t CVE-2022-22266.5An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a di CVE-2022-222609.1The kernel module has a UAF vulnerability.Successful exploitation of this vulnerability will affect data integrity and availability.CVE-2022-222617.5The HiAIserver has a vulnerability in verifying the validity of the weight used in the model.Successful exploitation of this vulnerability w CVE-2022-222627.7ROG Live Service’s function for deleting temp files created by installation has an improper link resolution before file access vulnerability CVE-2022-222635.5Unprotected dynamic receiver in SecSettings prior to SMR Jan-2022 Release 1 allows untrusted applications to launch arbitrary activity.CVE-2022-222647.1Improper sanitization of incoming intent in Dressroom prior to SMR Jan-2022 Release 1 allows local attackers to read and write arbitrary fil CVE-2022-222657.8An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code CVE-2022-222663.3(Applicable to China models only) Unprotected WifiEvaluationService in TencentWifiSecurity application prior to SMR Jan-2022 Release 1 allow CVE-2022-222673.3Implicit Intent hijacking vulnerability in ActivityMetricsLogger prior to SMR Jan-2022 Release 1 allows attackers to get running application CVE-2022-222686.1Incorrect implementation of Knox Guard prior to SMR Jan-2022 Release 1 allows physically proximate attackers to temporary unlock the Knox Gu CVE-2022-222693.3Keeping sensitive data in unprotected BluetoothSettingsProvider prior to SMR Jan-2022 Release 1 allows untrusted applications to get a local