What’s Vulnerable › Vulnerabilities

CVE-2022-42488: Startup subsystem missed permission validation in param service. An malicious application installed on the device could elevate its privileges to the root user, disable security features, or cause DoS by disabling particular services.

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-14 · updated 2026-06-17
• Weakness: CWE-287

Description

OpenHarmony-v3.1.2 and prior versions have a Missing permission validation vulnerability in param service of startup subsystem. An malicious application installed on the device could elevate its privileges to the root user, disable security features, or cause DoS by disabling particular services.

Affected products

• Openharmony: from 3.1 before 3.1.2 — fixed in 3.1.2

How to fix

Upgrade to a fixed version: Openharmony 3.1.2. Check the vendor advisory for mitigations.

References

• https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-10.md
• https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-10.md

Get alerted when CVE-2022-42488 or the next vulnerability affects your stack