CVE-2023-44117 is a high severity (CVSS 7.5) flaw in how Huawei EMUI 13.0.0 and HarmonyOS 3.0.0 and 3.1.0 handle trust relationships in distributed scenarios. It can affect confidentiality of a service. Huawei's January 2024 security update addresses it, so install that update as soon as your device offers it.
What's affected
The record lists EMUI 13.0.0 and HarmonyOS 3.0.0 and 3.1.0. Huawei's bulletin lists EMUI 13.0.0 as affected and names the issue as inaccurate trust relationships in distributed scenarios. We read the consumer bulletin page, and it did not give a HarmonyOS version list or fixed build numbers. The HarmonyOS bulletin linked from the record may add detail, and we did not read it, so check it for your devices.
Severity differs between sources. The record scores 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, and Huawei's bulletin rates this one High, so on this CVE they agree. The weakness is CWE-290, an authentication bypass by spoofing class. The impact is limited to confidentiality. The record does not mark the CVE as known exploited.
How to check if you're exposed
- On a Huawei device, open Settings, then System and updates, then Software update, and note the EMUI or HarmonyOS version and the security patch level.
- Devices on EMUI 13.0.0, or HarmonyOS 3.0.0 or 3.1.0, with a patch level before January 2024 are in scope.
- Check Huawei's bulletin for your model.
- Review whether your devices use cross device features, such as connecting to other Huawei devices, which is what distributed scenarios refers to.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see installed desktop software or device firmware, but it covers the open source dependencies in your own code.
What to do now
- Install the January 2024 Huawei security update or later.
- If a device is no longer receiving updates, retire it or keep it off networks with sensitive data.
- Review device pairing and cross device sharing settings and remove devices you no longer use.
- Keep corporate data away from unmanaged phones.
- Check the bulletin for later fixes that supersede this one.
Why it matters
Distributed features let several devices act as one, for example sharing files or services between a phone and a tablet. That depends on devices trusting each other. If the trust decision is wrong, a device can be treated as trusted when it should not be.
The record's CWE is about trusting an identity that was not properly verified. Huawei gives few details, and that is common in consumer bulletins. Keep patch levels current and treat unpaired, unknown devices as untrusted.
Quick check
What does distributed scenarios mean?
It refers to features where several devices work together. Huawei does not give more detail in the bulletin.
Is this High or Medium?
Both the record and Huawei's bulletin rate it High.
Sources
- Huawei consumer security bulletin, January 2024
- HarmonyOS security bulletin, January 2024 (record reference, not read)
Last reviewed: 19 October 2026.
