Lucene search

[email protected]CVE-2019-5307

HistoryJun 04, 2019 - 7:29 p.m.

CVE-2019-5307

2019-06-0419:29:00

CWE-294

[email protected]

web.nvd.nist.gov

179

huawei

4g lte

p30

p30 pro

vulnerability

message replay

security issue

4.3 Medium

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:A/AC:M/Au:N/C:P/I:P/A:N

4.2 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.2%

JSON

Some Huawei 4G LTE devices, P30 versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) and P30 Pro versions before VOG-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1), are exposed to a message replay vulnerability. For the sake of better compatibility, these devices implement a less strict check on the NAS message sequence number (SN), specifically NAS COUNT. As a result, an attacker can construct a rogue base station and replay the GUTI reallocation command message in certain conditions to tamper with GUTIs, or replay the Identity request message to obtain IMSIs. (Vulnerability ID: HWPSIRT-2019-04107)

Affected configurations

NVD

Node

huaweip30_firmwareRange<ele-al00_9.1.0.162

AND

huaweip30Match-

Node

huaweip30_pro_firmwareRange<vog-al00_9.1.0.162

AND

huaweip30_proMatch-

CPENameOperatorVersion
huawei:p30_firmwarehuawei p30 firmwareltele-al00_9.1.0.162

CPE	Name	Operator	Version
huawei:p30_firmware	huawei p30 firmware	lt	ele-al00_9.1.0.162

CNA Affected

[
  {
    "product": "P30,P30 Pro",
    "vendor": "Huawei",
    "versions": [
      {
        "status": "affected",
        "version": "The versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1)"
      },
      {
        "status": "affected",
        "version": "The versions before VOG-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1)"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-replay-en

4.3 Medium

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:A/AC:M/Au:N/C:P/I:P/A:N

4.2 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.2%

JSON

Related for CVE-2019-5307

nvd1 huawei1 cvelist1 prion1