Medium severity · published Nov 29, 2019
CVE-2019-5227
P30, P30 Pro, Mate 20 smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1), versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R2P1), versions…
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
P30, P30 Pro, Mate 20 smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1), versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R2P1), versions earlier than Hima-AL00B 9.1.0.135(C00E133R2P1) and HiSuite with versions earlier than HiSuite 9.1.0.305 have a version downgrade vulnerability. The device and HiSuite software do not validate the upgrade package sufficiently, so that the system of smartphone can be downgraded to an older version.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HF
Hisuite Firmware · Huawei
before 9.1.0.305 · source: NVD
M2
Mate 20 Firmware · Huawei
before hima-al00b_9.1.0.135\(c00e133r2p1\) · source: NVD
PF
P30 Firmware · Huawei
before elle-al00b_9.1.0.193\(c00e190r2p1\) · source: NVD
PP
P30 Pro Firmware · Huawei
before vogue-al00a_9.1.0.193\(c00e190r2p1\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-5227
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-5227
Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190904-01-smartphone-en
More from Hisuite Firmware
5.5
CVE-2019-5226
P30, P30 Pro, Mate 20 smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1), versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R2P1), versions…