CVE-2025-31170 is a High severity (CVSS 8.4) access control flaw in the security verification module of Huawei HarmonyOS and EMUI. Huawei lists it in its April 2025 phone and tablet security bulletin. Install that month's update or a later one on affected devices.
What's affected
Huawei's April 2025 bulletin for phones and tablets lists CVE-2025-31170 as an access control vulnerability in the security verification module. Huawei says successful exploitation will affect integrity and confidentiality, and rates the issue High.
The bulletin names these affected versions: HarmonyOS 5.0.0, HarmonyOS 4.3.0, HarmonyOS 4.0.0 and EMUI 14.0.0. The record lists the products as Huawei EMUI and Huawei HarmonyOS.
The weakness is CWE-290, authentication bypass by spoofing. The vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes a local attack with low complexity and no user interaction, and it does not mark the CVE as in CISA KEV. The bulletin does not give a specific fixed build number in the text this post reviewed, so use the bulletin and your device update screen to confirm you have the April 2025 patch level or newer.
How to check if you're exposed
On a Huawei device, open Settings, then About phone (or About tablet), and read the system version and the security patch level. Compare it with the April 2025 bulletin. If the patch date is earlier than April 2025, the device lacks this fix.
For fleets, check with your mobile device management console. Most platforms can report the OS version and patch level per device, and some can report them for Huawei devices as well. Export the list and filter for HarmonyOS 4.0.0, 4.3.0, 5.0.0 and EMUI 14.0.0.
If you cannot read the patch level on managed devices, ask the device owner to send a screenshot of the About screen. A short list of unknown devices is easier to deal with than none at all.
What to do now
- Open the system update screen and install the latest available update, which should include the April 2025 security patches.
- For managed fleets, push the update through your device management tool and set a deadline for compliance.
- Check the Huawei bulletin to confirm the affected version for each device model before you retire or exempt any of them.
- If a device cannot receive updates, restrict it from accessing corporate data and plan to replace it.
- Keep a record of device patch levels, so the next monthly bulletin takes minutes to assess.
Why it matters
Bulletins like this one are short on detail by design. The bulletin names the module, the type of impact and the versions. It does not describe how the flaw works. That is normal for mobile operating system vendors, who publish a monthly batch of fixes and ask users to update.
The weakness class listed, CWE-290, relates to authentication that can be defeated by spoofing. In a security verification module, a flaw like this can weaken the checks the system uses before it grants access to protected resources. The practical takeaway for organizations is not about this one CVE. It is about having a routine: know which phones and tablets touch company data, know their patch levels, and set a maximum age for the latest installed update.
Quick check
Where do I find the fix?
Huawei's April 2025 security bulletin for phones and tablets lists the CVE. Install the latest system update on the device, which includes that month's patches.
Does this affect all Huawei devices?
The bulletin lists HarmonyOS 5.0.0, 4.3.0, 4.0.0 and EMUI 14.0.0 as affected. Check the bulletin for your model and version.
Sources
Last reviewed: 19 October 2026.
