Medium severity · published Nov 29, 2019
CVE-2019-5212
There is an improper access control vulnerability in Huawei Share
5.5
CVSS
0.5%
EPSS
No
On KEV
Description
There is an improper access control vulnerability in Huawei Share. The software does not properly restrict access to certain file from certain application. An attacker tricks the user into installing a malicious application then establishing a connect to the attacker through Huawei Share, successful exploit could cause information disclosure.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
P20 Firmware · Huawei
before emily-l29c_9.1.0.311\(c10e2r1p13t8\); before emily-l29c_9.1.0.311\(c461e2r1p11t8\); before emily-l29c_9.1.0.311\(c605e2r1p12t8\); before emily-l29c_9.1.0.311\(c432e7r1p11t8\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-5212
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-5212
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191113-01-share-en
More from P20 Firmware
7.8
CVE-2019-2215
Android Kernel Use-After-Free Vulnerability
8.8
CVE-2020-0022
In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation
5.9
CVE-2018-7987
There is an out-of-bounds write vulnerability on Huawei P20 smartphones with versions before 8.1.0.171(C00)
5.7
CVE-2019-5211
The Huawei Share function of P20 phones with versions earlier than Emily-L29C 9.1.0.311 has an improper file management vulnerability
5.5
CVE-2020-9239
Huawei smartphones BLA-A09 versions 8.0.0.123(C212),versions earlier than 8.0.0.123(C567),versions earlier than 8.0.0.123(C797);BLA-TL00B versions earlier than…