Security readout for executives and security teams
Plain-English summary
Huawei disclosed a key-management flaw affecting smartphones running EMUI 11.0.0 or Magic UI 4.0.0. Successful exploitation could affect confidentiality, availability, and integrity. Public details are sparse, so business urgency should be driven by whether affected Huawei devices handle sensitive data or critical workflows.
Executive priority
Set priority after asset discovery. If affected Huawei devices are present in sensitive roles, treat this as a timely patch and device-governance issue despite the missing severity score.
Technical view
CVE-2021-22375 is described as a Key Management Errors vulnerability in Huawei smartphone software. The public record identifies EMUI 11.0.0 and Magic UI 4.0.0 as affected, but provides no CVSS score, CWE mapping, attack vector, prerequisites, or detailed remediation information in the supplied bundle.
Likely exposure
Exposure appears limited to Huawei smartphones running EMUI 11.0.0 or Magic UI 4.0.0. Organizations with managed Huawei mobile fleets, privileged mobile users, or sensitive mobile workflows should validate versions and patch status.
Exploitation context
The supplied bundle does not show CISA KEV listing or cited evidence of active exploitation. It also does not provide exploit mechanics, public exploit availability, or confirmed attack prerequisites.
Researcher notes
The public metadata is minimal. Avoid assuming attack vector, exploitability, or fixed versions beyond Huawei guidance. The key research task is correlating Huawei bulletin details with specific device models, build numbers, and enterprise fleet exposure.
Mitigation direction
- Check Huawei's May 2021 security bulletin for vendor remediation guidance.
- Update affected EMUI and Magic UI devices to vendor-supported fixed builds where available.
- Prioritize devices used by executives, administrators, or sensitive-data handlers.
- Retire or isolate unsupported affected devices from sensitive workflows.
Validation and detection
- Inventory Huawei devices and record EMUI or Magic UI versions.
- Identify devices running EMUI 11.0.0 or Magic UI 4.0.0.
- Confirm whether Huawei security updates after the May 2021 bulletin are installed.
- Review mobile device management records for patch compliance and unsupported devices.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-22375 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://consumer.huawei.com/en/support/bulletin/2021/5/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.