Security readout for executives and security teams
Plain-English summary
CVE-2021-22400 affects some Huawei smartphones. A malicious app installed by a tricked user can change specific parameters and crash the system. The available sources describe a denial-of-service style impact, not data theft or remote compromise.
Executive priority
Treat as targeted device hygiene, not an enterprise-wide emergency unless affected Huawei devices are present. Prioritize inventory confirmation first, then vendor-guided firmware remediation and app-install controls.
Technical view
The issue is insufficient input validation from missing parameter validation on Huawei OxfordS-AN00A builds listed in the CVE record. The attack requires the user to install a malicious app, which can modify specific parameters and cause a system crash. No CVSS, CWE, or detailed fix is provided in the supplied sources.
Likely exposure
Exposure appears limited to Huawei OxfordS-AN00A devices running the listed 10.0.1.x and 10.1.0.202 firmware builds. Organizations without those devices are unlikely to be affected based on the supplied source bundle.
Exploitation context
The source bundle does not show CISA KEV listing or other evidence of active exploitation. The documented path is social engineering: convincing a user to install a malicious app that can trigger a crash.
Researcher notes
Evidence is sparse. The supplied sources identify the affected model and versions, prerequisite malicious app installation, and crash impact. They do not provide CVSS, CWE, proof of exploitation, exploit details, or a specific patched version in the provided bundle.
Mitigation direction
- Inventory Huawei OxfordS-AN00A devices and firmware versions.
- Check Huawei PSIRT guidance for fixed or recommended firmware.
- Restrict installation of untrusted or unknown-source apps.
- Use mobile policy controls to reduce malicious app installation risk.
- Do not close remediation without confirming vendor guidance.
Validation and detection
- Compare device firmware against the affected version list.
- Confirm whether any Huawei OxfordS-AN00A devices are in use.
- Review mobile app installation policy and enforcement.
- Check crash reports correlated with newly installed apps.
- Record vendor advisory status in vulnerability tracking.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-22400 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210721-01-phones-enCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.