Security readout for executives and security teams
Plain-English summary
CVE-2021-22351 affects Huawei EMUI and Magic UI smartphones. The issue involves improper credential or permission handling that could induce users to grant permission to modify configuration table items. The reported impact is system exceptions, not confirmed data theft or remote takeover in the supplied sources.
Executive priority
Treat this as a targeted mobile fleet hygiene issue rather than a confirmed emergency. The business priority is identifying affected Huawei devices and ensuring they follow Huawei update guidance, especially for managed devices used with enterprise accounts.
Technical view
The CVE describes a credentials management error in EMUI 10.1.1, 11.0.0, 11.0.1 and Magic UI 3.1.1, 4.0.0. Successful exploitation may cause users to authorize changes to configuration-table items, resulting in system exceptions. No CVSS vector, CWE mapping, exploit detail, or fixed build information is provided in the bundle.
Likely exposure
Exposure is limited to Huawei smartphones running the listed EMUI or Magic UI versions. Organizations with managed Huawei Android fleets should inventory OS versions and compare them with Huawei guidance.
Exploitation context
The supplied sources do not show active exploitation, and the CVE is not listed as KEV. The description suggests user interaction is involved, but available evidence does not define attack prerequisites, privileges, or practical exploitation path.
Researcher notes
Evidence is sparse: no CVSS, CWE, exploitability detail, or explicit fixed build appears in the supplied bundle. Analysis should remain bounded to the stated credential-management error, user-induced permission grant, configuration-table modification, and system-exception impact.
Mitigation direction
- Check Huawei's May 2021 security bulletin for vendor-provided remediation guidance.
- Update affected EMUI and Magic UI devices through official Huawei channels where updates are available.
- Prioritize managed or business-critical Huawei smartphones running the listed versions.
- Restrict installation of untrusted apps through mobile device management where feasible.
Validation and detection
- Inventory Huawei devices and record EMUI or Magic UI version numbers.
- Compare device versions against the affected versions named in the CVE record.
- Confirm devices have received applicable Huawei security updates or vendor-directed remediation.
- Review mobile management telemetry for affected versions still active in the fleet.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-22351 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://consumer.huawei.com/en/support/bulletin/2021/5/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.