High severity · published Jun 6, 2019
CVE-2019-5216
There is a race condition vulnerability on Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.156(C00E156R2P14T8), Honor 10 smartphones versions earlier than…
7.0
CVSS
0.7%
EPSS
No
On KEV
Description
There is a race condition vulnerability on Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.156(C00E156R2P14T8), Honor 10 smartphones versions earlier than Columbia-AL10B 9.0.0.156(C00E156R1P20T8) and Honor Play smartphones versions earlier than Cornell-AL00A 9.0.0.156(C00E156R1P13T8). An attacker tricks the user into installing a malicious application, which makes multiple processes to operate the same variate at the same time. Successful exploit could cause execution of malicious code.
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H1
Honor 10 Firmware · Huawei
before columbia-al10b_9.0.0.156\(c00e156r1p20t8\) · source: NVD
HP
Honor Play Firmware · Huawei
before cornell-al00a_9.0.0.156\(c00e156r1p13t8\) · source: NVD
HV
Honor View 10 Firmware · Huawei
before berkeley-al20_9.0.0.156\(c00e156r2p14t8\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-5216
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-5216
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190116-01-smartphone-en
More from Honor 10 Firmware
5.5
CVE-2020-9255
Huawei Honor 10 smartphones with versions earlier than 10.0.0.178(C00E178R1P4) have a denial of service vulnerability
5.5
CVE-2020-1785
Mate 10 Pro;Honor V10;Honor 10;Nova 4 smartphones have a denial of service vulnerability