Lucene search

[email protected]CVE-2019-5226

HistoryNov 29, 2019 - 7:15 p.m.

CVE-2019-5226

2019-11-2919:15:12

CWE-346

[email protected]

web.nvd.nist.gov

cve-2019-5226

huawei

smartphones

hisuite

version downgrade

vulnerability

security

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.0%

JSON

P30, P30 Pro, Mate 20 smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1), versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R2P1), versions earlier than Hima-AL00B 9.1.0.135(C00E133R2P1) and HiSuite with versions earlier than HiSuite 9.1.0.305 have a version downgrade vulnerability. The device and HiSuite software do not validate the upgrade package sufficiently, so that the system of smartphone can be downgraded to an older version.

Affected configurations

NVD

Node

huaweip30_firmwareRange<elle-al00b_9.1.0.193\(c00e190r2p1\)

AND

huaweip30Match-

Node

huaweip30_pro_firmwareRange<vogue-al00a_9.1.0.193\(c00e190r2p1\)

AND

huaweip30_proMatch-

Node

huaweimate_20_firmwareRange<hima-al00b_9.1.0.135\(c00e133r2p1\)

AND

huaweimate_20Match-

Node

huaweihisuite_firmwareRange<9.1.0.305

AND

huaweihisuiteMatch-

CPENameOperatorVersion
huawei:p30_firmwarehuawei p30 firmwareltelle-al00b_9.1.0.193\(c00e190r2p1\)

CPE	Name	Operator	Version
huawei:p30_firmware	huawei p30 firmware	lt	elle-al00b_9.1.0.193\(c00e190r2p1\)

CNA Affected

[
  {
    "product": "P30, P30 Pro, Mate 20, HiSuite",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1), Versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R2P1), Versions earlier than Hima-AL00B 9.1.0.135(C00E133R2P1), Versions earlier than HiSuite 9.1.0.305"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20190904-01-smartphone-en

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.0%

JSON

Related for CVE-2019-5226

prion1 nvd1 cvelist1 huawei1