CVE-2021-46787

What it actually does

Improper permission control in the AMS module allows non-system application processes to trigger crashes in other application processes over the network without authentication.

Why it matters to the business

Attackers can cause denial-of-service conditions on affected Huawei devices, disrupting app availability and user workflows on widely deployed consumer mobile platforms.

How an attack unfolds

An unauthenticated attacker sends specially crafted requests to the AMS module on a vulnerable device, bypassing intended permission checks and forcing target application processes to terminate.

How to fix it

Update affected Huawei EMUI, Magic UI and HarmonyOS installations to the latest vendor-supplied firmware that corrects the AMS permission enforcement; monitor Huawei security bulletins for patch availability.

How to confirm the fix worked

Confirm devices are running patched firmware versions, review AMS permission enforcement in updated builds, and test that non-system applications can no longer induce process crashes.

Typical attack path

1. Identify reachable vulnerable Huawei device running affected EMUI, Magic UI or HarmonyOS
2. Craft and send network requests that abuse the AMS permission flaw
3. Trigger repeated process crashes to achieve denial of service
4. Optionally chain with other techniques to maintain disruption

How to detect it

Review system and application crash logs for repeated unexpected terminations of non-system processes originating from AMS interactions; correlate with network activity to the device.

What your security team should do

• Prioritize deployment of Huawei security updates on all managed devices
• Restrict sideloading of untrusted applications until patches are applied
• Monitor Huawei security advisories for any newly disclosed fixed versions
• Apply network segmentation or firewall rules to limit exposure of mobile devices where feasible