Medium severity · published Jun 4, 2019
CVE-2019-5215
There is a man-in-the-middle (MITM) vulnerability on Huawei P30 smartphones versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1), and P30 Pro versions before VOG-AL00…
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
There is a man-in-the-middle (MITM) vulnerability on Huawei P30 smartphones versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1), and P30 Pro versions before VOG-AL00 9.1.0.162 (C01E160R1P12/C01E160R2P1). When users establish connection and transfer data through Huawei Share, an attacker could sniff, spoof and do a series of operations to intrude the Huawei Share connection and launch a man-in-the-middle attack to obtain and tamper the data. (Vulnerability ID: HWPSIRT-2019-03109)
CVSS vector
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
P30 Firmware · Huawei
before ele-al00_9.1.0.162\(c01e160r1p12\/c01e160r2p1\) · source: NVD
PP
P30 Pro Firmware · Huawei
before vog-al00_9.1.0.162\(c01e160r1p12\/c01e160r2p1\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-5215
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-5215
Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190517-01-share-en
More from P30 Firmware
8.8
CVE-2020-0022
In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation
7.8
CVE-2020-9247
There is a buffer overflow vulnerability in several Huawei products
7.8
CVE-2020-9263
HUAWEI Mate 30 versions earlier than 10.1.0.150(C00E136R5P3) and HUAWEI P30 version earlier than 10.1.0.160(C00E160R2P11) have a use after free vulnerability
7.8
CVE-2020-1800
HUAWEI smartphones P30 with versions earlier than 10.0.0.185(C00E85R1P11) have an improper access control vulnerability
7.8
CVE-2020-1812
HUAWEI P30 smartphones with versions earlier than 10.0.0.173(C00E73R1P11) have an improper authentication vulnerability