CVE-2016-4575: Cross-site scripting (XSS) vulnerability in the email APP in Huawei PLK smartphones with software AL10C00 b...

Security readout for executives and security teams

This is an email-app cross-site scripting flaw in specific older Huawei smartphone software builds. A malicious email could cause script or HTML to run inside the phone’s email app. Business urgency is mainly for fleets still using the listed Huawei PLK, ATH, CherryPlus, or RIO models. Exposure appears limited to organizations or users still operating the listed Huawei smartphone models on vulnerable pre-fixed builds, especially where the bundled email app is used. Modern fleets without these models or builds are unlikely to be exposed based on the provided sources. Treat this as a targeted legacy-mobile exposure check, not a broad enterprise emergency. Prioritize asset discovery and patch verification where the named Huawei devices remain in use, because the supplied sources do not show active exploitation or severity scoring. Mitigation focus: Inventory Huawei PLK, ATH, CherryPlus, and RIO devices in managed fleets.; Upgrade affected software branches to the fixed build listed in the CVE or later.; Check Huawei PSIRT guidance for any model-specific update instructions..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.