{"id":"CVE-2022-48518","url":"https://www.cyber-defence.io/tools/cve/CVE-2022-48518","generatedAt":"2026-10-27T17:45:22.026Z","title":"Vulnerability of signature verification in the iaware system being initialized later than the time when the system broadcasts are sent.","description":"Vulnerability of signature verification in the iaware system being initialized later than the time when the system broadcasts are sent. Successful exploitation of this vulnerability may cause malicious apps to start upon power-on by spoofing the package names of apps in the startup trustlist, which affects system performance.","published":"2023-07-06T13:15:11.000Z","lastModified":"2026-06-17T05:15:36.000Z","status":"Modified","sourceIdentifier":"psirt@huawei.com","cvss":{"version":"3.1","score":5.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},"cwe":["CWE-701","CWE-665"],"affected":["huawei/emui","huawei/harmonyos"],"epss":{"score":0.00131,"percentile":0.02678,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.13%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2023/7/","tags":["Vendor Advisory"],"source":"psirt@huawei.com"},{"url":"https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-0000001587168858","tags":["Vendor Advisory"],"source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletin/2023/7/","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-0000001587168858","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-48518","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}