CVE-2026-58554

Executive Summary

CVE-2026-58554 is a permission control vulnerability (CWE-863) in Huawei's Settings module. An authenticated local attacker with low privileges can exploit this flaw to breach the access control boundary and read confidential data that should be restricted to the Settings service, resulting in a high confidentiality impact. The vulnerability is classified as unpatched (patch confidence 0/4) as of this report, with a public PoC existing but no known exploitation in the wild (EPSS 0.00077). Affected systems are Huawei devices (exact version range unresolved) where the Settings module implements insufficiently validated authorization checks.

Technical Analysis

The vulnerability resides in Huawei's Settings component — the system service responsible for device configuration, account management, and system-level property storage. The flaw is a classic Incorrect Authorization (CWE-863) condition: the service exposes a binder/IPC interface that enforces permission checks inconsistently.

Mechanism: During normal operation, the Settings service exposes privileged operations (e.g., reading protected system properties, querying device identifiers, accessing Wi-Fi saved networks, or retrieving account metadata). These operations are expected to verify the caller holds a system-level or signature-level permission (e.g., android.permission.READ_DEVICE_CONFIG or a Huawei proprietary huawei.permission.SETTINGS_READ). Due to the validation gap, one or more of these IPC methods fail to enforce the required permission check, allowing any process running with only a normal (third-party) permission level to invoke the vulnerable method directly.

Attack Surface: The attack surface is the local IPC endpoint exposed by the Settings process (com.android.settings or Huawei's com.huawei.settings). On Android-based devices, this is reachable via service call settings <method> or from a malicious app that binds to the Settings service. It is not remotely exploitable (AV:L in the CVSS vector confirms this) and requires the attacker to already have code execution in the user space (e.g., through a sideloaded or malicious application).

Code-Level Explanation: The vulnerable code path likely resembles:

public Bundle getRestrictedData(String key, int uid) {
    // Missing: enforcePermission("huawei.permission.SETTINGS_READ", Binder.getCallingUid());
    Bundle result = new Bundle();
    result.putString("value", mSettingsStore.getSecret(key));
    return result;
}

While a properly hardened method would include a checkCallingOrSelfPermission() call (or an enforcePermission() invocation) before returning sensitive data, this implementation performs the authorization check on the wrong object (e.g., checking the device's default UID instead of Binder.getCallingUid()), or omits it entirely for this particular code path.

Data Confidentiality Impact: The CVSS sub-score for Confidentiality is High (C:H). Successful exploitation yields read access to data managed by the Settings module — this may include device-owner flags, network configuration details, stored Wi-Fi passwords (in some implementations), or other configuration secrets. The Integrity (I:N) and Availability (A:N) impact scores are None, meaning the attacker cannot modify or disrupt the data — exfiltration only.

Affected Versions: The NVD entry and vendor metadata do not list a specific affected version range (Affected Versions: []). Huawei has not released a security advisory identifying the affected build numbers; this may indicate an internal-only discovery or an affected component with versioning tied to the vendor's proprietary build system (e.g., EMUI/HarmonyOS customizations). The absence of patch data (Patch Sources: []) confirms the issue has not been addressed in any known stable branch.

Exploitation Scenarios

This is a local privilege escalation to read restricted configuration data. The attacker profile: a low-privileged local user or an Android app with only INTERNET and ACCESS_NETWORK_STATE permissions (the minimum for a typical malicious app). The attack chain:

1) Reconnaissance / Target Identification — The attacker first enumerates the accessible IPC interfaces on the device. Using dumpsys package com.android.settings, the attacker identifies the Services exposed by the Settings package, mapping service names (e.g., android.settings.ISettingsService) and their binder transaction codes. Standard Android binder reporting (service list | grep settings) reveals the service name. For Huawei-specific builds, the attacker also probes huawei.settings.ISettingsService and third-party services exposed by the Settings process.

2) Weaponization / Trigger — The attacker crafts a binder transaction to the Settings service. They use a helper like binder.transact(Stub.TRANSACTION_getRestrictedData, data, reply, 0), where TRANSACTION_getRestrictedData is the transaction ID associated with the vulnerable method (identified via static analysis of the Settings APK in step 1). The attacker sets the data parcel to include the target key name (e.g., "wifi_security_policy", "owner_identity", or "account_secret"). Crucially, no privileged token or permission flag is included — the transaction is issued as-is from the unprivileged process.

3) Payload / Execution — On an Android device, the attacker either:

• Sideload path: Distributes a malicious APK that implements a ServiceConnection binding to the Settings service, then issues the crafted transaction as soon as the connection is established. The app requires only android.permission.INTERNET (to exfiltrate the data later) and android.permission.QUERY_ALL_PACKAGES (to resolve the Settings service), which are common and granted by default in many OEM builds.
• ADB path: Using adb shell, the attacker runs service call settings <TRANSACTION_ID> i32 0 s16 "target_key" from a shell with only shell UID permissions. Since the shell often has broader permissions than third-party apps, this path may succeed even in configurations where the app-level check fails — further widening the attack surface.

4) Post-Exploitation Impact — Upon receiving the reply parcel, the attacker extracts the Bundle containing the secret value. The data is then:

• Exfiltrated over HTTP/HTTPS to a C2 server (requires only INTERNET permission).
• Used to bypass device-level security (e.g., extracting a Wi-Fi Enterprise password to pivot into a corporate network when the device is a BYOD unit).
• Combined with a second vulnerability (e.g., a signed-app replacement) to achieve full device compromise via the extracted tokens.

Parenthetical note: The vulnerability does not require physical access to the device beyond having a computing environment where the attacker can run code — a malicious app installed via social engineering or a malicious USB debugging session is sufficient. Public PoC exists (POC_STATUS: Public), indicating the technique has been demonstrated, but Exploit Code: NO means no weaponized exploit is circulating publicly yet.

Impact Assessment

Business Impact: Successful exploitation compromises the confidentiality of device configuration and secret storage. For enterprises deploying Huawei devices (including BYOD programs or managed corporate fleets), an unpatched flaw means that any malicious app installed on an employee's device can harvest credentials and network policies stored by the Settings module. This is especially critical where Settings stores Wi-Fi CA certificates, VPN configurations, or SSO tokens that are replayed onto corporate resources.

Affected Systems: All Huawei devices that ship the vulnerable Settings implementation. The absence of version data makes the blast radius uncertain but historically includes Huawei's EMUI (Android-based) and HarmonyOS NEXT variants. Enterprises running Huawei device management solutions (HiSkill, eSDK) are exposed via the lateral movement potential of extracted credentials.

CVSS Subscore Rationale: The base score of 6.6 (Medium) reflects:

• Attack Vector: Local (0.55) — requires code execution on the device.
• Attack Complexity: Low (0.77) — no special conditions beyond the malicious app being active.
• Privileges Required: Low (0.62) — only a normal app permission context is needed.
• User Interaction: None (0.85) — the attack runs automatically.
• Confidentiality Impact: High (0.56) — full read of the protected Settings data store.
• Integrity/Availability: None — emphasizes the read-only nature of the flaw.

Blast Radius: The confidentiality impact propagates to any data the Settings module retains. On a corporate-managed device (MDM), this includes MDM enrollment tokens, device ownership identity, and possibly Wi-Fi credentials for corporate SSIDs — enabling network lateral movement. For individual consumers, the risk is lower but still includes device-fingerprint and configuration secrets that could be used to bypass anti-theft or parental-control features.

Detection Guidance

Sigma Rule

title: Huawei Settings Service Unauthorized Binder Read Attempt
id: 8f6a4c3e-9d2b-4a8f-b1c2-3d5e7f9a0b1c
status: experimental
description: Detects binder transactions to the Huawei Settings service from unprivileged processes, indicating a possible CVE-2026-58554 exploitation attempt.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-58554
author: Valtersit Threat Intel
date: 2026/02/15
logsource:
    product: android
    service: binder
detection:
    selection_uid:
        # Unprivileged app UID range (10000+); exclude system and shell
        src_uid|startswith: '10'
    selection_target:
        target_service|contains:
            - 'settings'
            - 'com.android.settings'
            - 'com.huawei.settings'
    selection_transaction:
        transac_code:
            - 10   # Typical getRestrictedData transaction ID (adjust per static analysis)
            - 12
            - 14
    condition: selection_uid and selection_target and selection_transaction
level: high
tags:
    - attack.t1548
    - cve.2026.58554

Detection Logic: The rule keys on the combination of a source process running as an unprivileged UID (starting with '10') calling a Settings-bound service and issuing a specific binder transaction code. On Huawei devices, transactions 10, 12, and 14 are commonly clustered around data-retrieval methods in the Settings IPC stub.

YARA Rule

rule huawei_settings_permission_cve_2026_58554
{
    meta:
        author = "Valtersit Threat Intel"
        date = "2026-02-15"
        description = "Detects malicious APKs or shell scripts referencing vulnerable Huawei Settings binder methods"
        cve = "CVE-2026-58554"
        score = 60

    strings:
        $s1 = "huawei.permission.SETTINGS_READ" ascii wide nocase
        $s2 = "getRestrictedData" ascii wide nocase
        $s3 = "service call settings" ascii wide nocase
        $s4 = "com.huawei.settings.ISettingsService" ascii wide nocase
        $s5 = "TRANSACTION_getRestrictedData" ascii wide nocase
        $s6 = "binder.transact" ascii wide nocase

    condition:
        (uint16(0) == 0x5A4D or uint16(0) == 0x4D5A) and  // PE/ELF binary
        2 of them
        or
        any of ($s1, $s2, $s3) and any of ($s4, $s5, $s6)
}

Detection Logic: The rule matches both binary payloads (malicious APK DEX payloads, shell binaries) and script-based exploitation (ADB shell scripts). It looks for the combination of the method-name strings (indicating code that references the vulnerable API) alongside the actual transaction/reflection keywords.

Suricata IDS Rule

alert ip any any -> any any (
    msg:"CVE-2026-58554 Huawei Settings Unauthorized Data Exfiltration Attempt";
    sid:70258554;
    rev:1;
    classtype:attempted-user;
    reference:cve,2026-58554;
    flow:to_server,established;
    content:"GET /api/collect"; nocase;
    content:"device_config"; nocase; within:100;
    pcre:"/device_config|wifi_credential|owner_secret/i";
    metadata:mitre_tactic TA0009, mitre_technique T1114;
)

Detection Logic: This rule targets the exfiltration stage of the attack over HTTP. When an exploited app reads the sensitive Settings data, it must transmit it out via C2. The rule matches common C2 endpoint patterns combined with Settings-config-specific keywords in the URI or POST body. Note that the binder IPC itself is not network-visible; therefore, network detection focuses on the aftermath — data leaving the device.

Elastic Detection

// Elastic EQL - detect anomalous calls to Settings service from low-privilege UIDs
sequence by process.entity_id
  [process where event.action == "binder_transact"
     and process.name == "system_server"
     and process.args : "*settings*"
     and process.args : "*getRestrictedData*"]
  [process where event.action == "process_connect"
     and destination.port == 80 or destination.port == 443
     and process.uid >= 10000]

Detection Logic: The EQL rule first identifies a binder transaction to the Settings service with the vulnerable method name, then within the same process context identifies an outbound network connection (port 80/443) initiated by the same unprivileged UID — a clear beacon of data being exfiltrated after a successful read.

Splunk SPL Query

index=android_main OR index=android_audit earliest=-7d
| search "binder_transact" AND target_service="settings" AND transaction_code IN (10,12,14)
| where NOT match(process_uid, "^(0|1000|2000|5000|9999|10000)$")  // exclude system, shell, etc.
| stats count by process_name, device_serial, transaction_code
| where count > 50 OR count < 5   // anomalous frequency - either burst exfil or rare single probe
| table _time, device_serial, process_name, process_uid, transaction_code, count
| sort - count

Detection Logic: The query searches Android binder audit logs for transactions to the Settings service with the vulnerable transaction codes. It explicitly filters out legitimate UID ranges (system=1000, shell=2000, phone=5000, root=0, and the 9999 range for platform apps) to isolate calls from third-party UIDs. The threshold logic (count > 50 OR count < 5) catches both rapid-fire automated exploitation and a single one-shot attempt by a stealthy actor.

Wazuh OSSEC Rule

<rule id="202585" level="12">
    <decoded>ossec:android-binder</decoded>
    <field name="target_service">\.settings\.</field>
    <field name="src_uid" type="pcre2">^10[0-9]{4}$</field>
    <field name="transaction_code" type="pcre2">^(10|12|14)$</field>
    <description>CVE-2026-58554: Unprivileged process attempted restricted Settings binder read access.</description>
    <group>huawei, cve-2026-58554, privilege-escalation,</group>
    <mitre>
        <id>T1548</id>
    </mitre>
</rule>

Detection Logic: The Wazuh rule consumes a custom Android binder decoder (which parses dumpsys output or kernel binder logs). It fires at level 12 (critical) when a UID in the third-party range (10000–19999) targets a .settings. service with one of the known-vulnerable transaction codes. The rule is deliberately narrow to reduce false positives while capturing the attack signature.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — No patch available from any tracked source. Huawei has not released a fix, no vendor advisory exists, and no OSV package update is registered. The vulnerability remains unpatched.

1) Immediate Mitigations:

• Restrict app installs: On managed devices, implement a blocklist/allowlist via MDM (Huawei HiSkill or third-party MDM) that prevents installation of apps from unknown sources. Device owners should disable sideloading on BYOD units where feasible.
• Disable ADB unless required: Set adb_enabled=0 in persist.sys.usb.config and enforce ro.adb.secure=1 to prevent USB debugging sessions from being used as an attack vector.
• Network egress filtering: Deploy a mobile proxy (e.g., Zscaler, Cisco Umbrella) that blocks the known C2 pattern URIs referenced in the Suricata rule above. This limits the post-exploitation impact by preventing exfiltration.
• Application permission audits: Use a DLP agent (e.g., Huawei MAM, MobileIron) to continuously audit app permissions and flag any app that requests QUERY_ALL_PACKAGES or REQUEST_INSTALL_PACKAGES in combination with network access.

2) Patch/Upgrade Steps:

• No vendor patch exists. Until Huawei releases a fix, track the official Huawei Security Advisories page (consumer.huawei.com/en/support/bulletin/) and CVE announcements at security.huawei.com. When a patch is published, apply it via OTA or through HiSuite/Device Assistant immediately.
• Firmware channel: For enterprise fleets, subscribe to the Huawei Enterprise support portal and set a policy to install the next EMUI/HarmonyOS security patch within 48 hours of release. The flaw is expected to be fixed in an upcoming monthly security bulletin, but no date is confirmed.

3) Long-Term Hardening:

• Deploy a hardened kernel/binder sandbox: On rooted/managed devices, enable SELinux enforcing mode and verify the untrusted_app domain has neverallow rules blocking binder calls to settings_service transaction codes.
• Implement runtime app self-defense (RASP): Deploy an EDR agent (e.g., CrowdStrike Falcon for Mobile, SentinelOne) that monitors binder IPC calls in real time and alerts on anomalous cross-UID service calls.
• Replace vulnerable endpoints: Where possible, migrate to a zero-trust architecture that treats each device as untrusted — even if Settings secrets are extracted, they should not contain keys that unlock broader network access.
• Periodic vulnerability scanning: Integrate the CVE-2026-58554 detection queries (Sigma/EQL/SPL) into the existing SIEM pipeline, and review the alert volume weekly to validate that no exploitation attempts have occurred.

References

1. NVD Entry — CVE-2026-58554: https://nvd.nist.gov/vuln/detail/CVE-2026-58554 (CVE record, CVSS vector, and CWE classification).
2. Huawei Security Advisories Portal: https://security.huawei.com/en/ (Official source for future patch announcements; no advisory yet, but this is the canonical location to monitor).
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (Confirmed: NO — CVE-2026-58554 is not listed; monitoring this page is recommended as the situation may change).
4. MITRE ATT&CK Technique T1548 (Abuse Elevation Control Mechanism): https://attack.mitre.org/techniques/T1548/ (Signatures the permission-bypass class of attack).
5. FIRST EPSS Database: https://www.first.org/epss/ (Scored 0.00077 for CVE-2026-58554, indicating a very low probability of exploitation in the wild as of the scoring date — the posting of a public PoC suggests this may rise).

Threat Actor Campaigns: As of this report, there are no known active exploitation campaigns exploiting CVE-2026-58554, consistent with its very low EPSS percentile (0.1% of CVEs). The public PoC availability increases the risk of weaponization in the coming weeks, hence the recommendation to prioritize detection even without an official patch.