Security readout for executives and security teams
Plain-English summary
This Huawei smartphone vulnerability is a reliability and availability risk. A bug in buffer-size calculation can be exploited to reset the system. Public sources identify affected EMUI and Magic UI versions, but they do not provide CVSS scoring, detailed prerequisites, or confirmed exploitation.
Executive priority
Prioritize based on Huawei device presence and business reliance. This is not currently shown as exploited, but affected devices could suffer forced resets, disrupting users and possibly mobile workflows.
Technical view
CVE-2021-22391 describes an incorrect buffer-size calculation in Huawei smartphones affecting listed EMUI and Magic UI releases. The documented impact is system reset. No CWE, CVSS vector, attack vector, or remediation detail is present in the provided data.
Likely exposure
Exposure is likely limited to Huawei smartphones running EMUI 9.1.0, 9.1.1, 10.0.0, 10.1.0, 10.1.1, or 11.0.0, and Magic UI 2.1.1, 3.0.0, 3.1.0, 3.1.1, or 4.0.0.
Exploitation context
The provided sources do not show active exploitation, public exploit availability, or CISA KEV listing. The only stated outcome is system reset, so treat exploitation evidence as incomplete rather than confirmed in the wild.
Researcher notes
Public metadata is sparse: no CVSS, CWE, attack vector, prerequisites, or detailed fix text were provided. Avoid assuming memory corruption impact beyond the stated system reset without vendor detail.
Mitigation direction
- Inventory Huawei smartphones and record EMUI or Magic UI versions.
- Review Huawei’s June 2021 bulletin and device-specific update guidance.
- Apply vendor firmware or security updates where available for affected devices.
- Restrict unsupported or unpatched affected devices from sensitive corporate access.
- Monitor mobile device crashes or resets for unusual clustering.
Validation and detection
- Confirm whether managed or BYOD Huawei devices run affected versions.
- Verify security patch levels against Huawei’s official bulletin guidance.
- Check MDM records for unsupported Huawei devices with corporate access.
- Document exceptions where updates are unavailable or devices are user-owned.
- Track reset incidents after remediation to confirm stability improvement.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-22391 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://consumer.huawei.com/en/support/bulletin/2021/6/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.