CVE-2023-39404

HighCVSS 7.5/10Last modified Nov 10, 2026

Description

Vulnerability of input parameter verification in certain APIs in the window management module. Successful exploitation of this vulnerability may cause the device to restart.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Huawei	HarmonyOS	3.1.0; 3.0.0
Huawei	EMUI	13.0.0

References

https://consumer.huawei.com/en/support/bulletin/2023/8/Vendor Advisory
https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-0000001667644725Vendor Advisory
https://consumer.huawei.com/en/support/bulletin/2023/8/Vendor Advisory
https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-0000001667644725Vendor Advisory

Timeline

Published: Aug 13, 2023
Last modified: Nov 10, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-394059.8Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Successful exploitation of this vulnerability may cause other apps CVE-2023-394067.5Permission control vulnerability in the XLayout component. Successful exploitation of this vulnerability may cause apps to forcibly restart.CVE-2023-394079.1The Watchkit has a risk of unauthorized file access.Successful exploitation of this vulnerability may affect confidentiality and integrity.CVE-2023-394087.5DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.CVE-2023-394097.5DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.CVE-2023-394110.0Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to write any file on the system with root privileges.CVE-2023-394107.5When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead t CVE-2023-394114.4Improper input validationation for some Intel Unison software may allow a privileged user to potentially enable denial of service via local CVE-2023-394128.8Cross-site request forgery in some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via n CVE-2023-394137.8Multiple integer underflow vulnerabilities exist in the LXT2 lxt2_rd_iter_radix shift operation functionality of GTKWave 3.3.115. A speciall CVE-2023-394147.3Multiple integer underflow vulnerabilities exist in the LXT2 lxt2_rd_iter_radix shift operation functionality of GTKWave 3.3.115. A speciall CVE-2023-394157.5Improper authentication vulnerability in Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlie