CVE-2023-52116: High Multi-Screen Permission Flaw in Huawei EMUI

CVE-2023-52116 is a high severity (7.5 CVSS) flaw in Huawei's EMUI, described as: permission management vulnerability in the multi-screen interaction module. Huawei's January 2024 bulletin lists it as fixed in that month's security update. Devices on the affected EMUI versions should take the update.

What's affected

Huawei's January 2024 EMUI bulletin lists the affected versions as EMUI 13.0.0, EMUI 12.0.0 and EMUI 11.0.1. The NVD record lists emui 11.0.1, emui 12.0.0, emui 13.0.0. That matches the bulletin for the EMUI versions.

The weaknesses are classed as CWE-269 (Improper Privilege Management) and CWE-732 (Incorrect Permission Assignment for Critical Resource). Huawei's stated impact is that successful exploitation may affect device service exceptions.

The two sources disagree on severity. NVD scores this 7.5 (High), while Huawei's bulletin rates it Medium. Neither source gives the full reasoning, so plan around the higher rating and still install the update.

How to check if you're exposed

There is no package manager to query on a phone. Use the device and the bulletin instead.

1. Open the software update screen in the device settings and read the current EMUI version and security patch level.
2. Compare it with the January 2024 entry in Huawei's EMUI security bulletin.
3. If the device is on an affected EMUI version and has not taken the January 2024 or a later update, treat it as exposed.

For a fleet, ask your mobile device management tool to report OS and patch level for every Huawei device, and list the ones that fall behind. Devices that no longer receive updates need a replacement plan.

What to do now

1. Install the latest available system update on each Huawei device in scope.
2. Confirm the patch level afterwards, since updates sometimes fail quietly.
3. For devices that cannot update, restrict what they can reach and what data they hold.
4. Record the device models and versions you checked, so an auditor or a colleague can see the result.
5. Watch Huawei's monthly bulletins for related entries, since this CVE belongs to a batch of fixes.

Why it matters

The bulletin gives a short description and no more, so the cause is known only at the level of the module name and weakness class. The module affected is multi-screen interaction module, and the vector scores the attack as network based with low complexity and no privileges. A network vector on a phone component does not always mean a remote attacker can reach it freely, because the exact entry point is not published.

We do not claim exploitation. The KEV flag in the record is false, and the bulletin does not say the flaw was used in attacks.

Quick check

Sources

• Huawei EMUI security updates, January 2024
• Huawei HarmonyOS security bulletin, January 2024
• Gold page for CVE-2023-52116

Last reviewed: 19 October 2026.