CVE-2023-0036 is an authentication bypass vulnerability affecting OpenHarmony-v3.0.5 and earlier versions, specifically within the platform_callback_stub in the misc subsystem. This flaw allows a local attacker to perform an "SA relay attack," bypassing authentication to target other highly privileged SAs. The vulnerability carries a CVSS v3.1 score of 7.8 (High), indicating a significant risk due to its low attack complexity and the potential for high impact on confidentiality, integrity, and availability. An attacker with local access can exploit this without user interaction. Currently, there is no public exploit code available (Metasploit, Nuclei, ExploitDB), and it is not listed in the CISA KEV catalog. Community discussion and media coverage are minimal, suggesting low awareness and no active exploitation at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 3.0, <= 3.0.5CPE matchmatch criteria | cpe:2.3:o:openatom:openharmony:*:*:*:*:lts:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.