CVE-2025-2188 is a high severity whitelist mechanism bypass (CVSS 8.1) in Honor GameCenter that may affect the confidentiality and integrity of the service. Honor lists com.hihonor.gamecenter version 16.0.23.304 as the resolved version, so update the app to that version or later.
What's affected
- Product: Honor GameCenter, package
com.hihonor.gamecenter - Fixed version: 16.0.23.304, per Honor's security advisory
- Weakness: authentication bypass by spoofing (CWE-290)
- CVSS: 8.1 (High), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Published: 2025-04-17
Honor's advisory is short. It describes a bypass of the whitelist mechanism and says successful exploitation may affect service confidentiality and integrity. It does not describe the mechanism, and I will not guess at one. The vector shows a network attack that needs user interaction. The CISA Known Exploited Vulnerabilities flag is false for this CVE, and none of the pages I read report active exploitation.
How to check if you're exposed
Check the installed version on the device.
- Open Settings, then Apps, then GameCenter, and read the version at the bottom.
- Compare it with 16.0.23.304. Anything older is affected.
- From a computer with USB debugging enabled, you can read the version directly, though you should confirm the package name on your device first.
adb shell dumpsys package com.hihonor.gamecenter | grep versionName
Honor says that devices that support automatic update will receive an update prompt. If a device shows no prompt, open the app store and check for updates manually. For managed devices, look at your MDM's application inventory and filter for older versions of the package.
What to do now
- Update Honor GameCenter to 16.0.23.304 or later on every Honor device you manage or own.
- Accept the automatic update prompt when it appears, and turn on automatic app updates.
- For fleets, report on this package's version in your device management tool and chase the stragglers.
- Read Honor's security advisory page for the latest list of fixed products, because the vendor says it updates that page as fixes are released.
- Treat apps that can reach into the network or load content as part of your normal patching, not just the operating system.
Why it matters
The record maps this to CWE-290, authentication bypass by spoofing. The app relies on a whitelist to decide what to trust, and the whitelist check can be gotten around. When a trust list can be bypassed, anything it was meant to keep out may get in.
The details are not public in the advisory, so the best use of this post is the simple one: confirm the version and update. The CVSS vector rates confidentiality and integrity impact as high with no effect on availability, and user interaction is needed. Pre installed vendor apps are easy to overlook because users did not choose them, which is why they deserve a place in the update report.
Quick check
Which version fixes it?
Honor lists com.hihonor.gamecenter 16.0.23.304 as the resolved version.
How will I get the update?
Honor says products that support automatic update will show an update prompt. You can also check the app store manually.
Sources
Last reviewed: 19 October 2026.
