CVE-2022-48298

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The geofencing kernel code does not verify the length of the input data. Successful exploitation of this vulnerability may cause out-of-bounds memory access.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-1284

Affected software

Vendor	Product	Versions
Huawei	HarmonyOS	2.0; 3.0.0
Huawei	EMUI	12.0.1

References

https://consumer.huawei.com/en/support/bulletin/2023/2/Vendor Advisory
https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-0000001454769474Patch, Vendor Advisory
https://consumer.huawei.com/en/support/bulletin/2023/2/Vendor Advisory
https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-0000001454769474Patch, Vendor Advisory

Timeline

Published: Feb 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-482997.5The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentialit CVE-2022-48305.4The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them CVE-2022-483007.5The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentialit CVE-2022-483017.5The bundle management module lacks permission verification in some APIs. Successful exploitation of this vulnerability may restore the pre-i CVE-2022-483027.5The AMS module has a vulnerability of lacking permission verification in APIs.Successful exploitation of this vulnerability may affect data CVE-2022-483035.5GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to c CVE-2022-483055.5There is an identity authentication bypass vulnerability in Huawei Children Smart Watch (Simba-AL00) 1.1.1.274. Successful exploitation of t CVE-2022-483066.8Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker CVE-2022-483073.7It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactor CVE-2022-483083.7It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory CVE-2022-483094.3A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90.CVE-2022-48315.4The Custom User Profile Fields for User Registration WordPress plugin before 1.8.1 does not validate and escape some of its shortcode attrib