Medium severity · published Dec 14, 2019
CVE-2019-5235
Some Huawei smart phones have a null pointer dereference vulnerability
5.3
CVSS
0.9%
EPSS
No
On KEV
Description
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Alp-al00b Firmware · Huawei
8.0.0.153(c00) · source: NVD
AF
Alp-tl00b Firmware · Huawei
8.0.0.129(sp2c01) · source: NVD
BF
Bla-al00b Firmware · Huawei
8.0.0.129(sp2c786); 8.0.0.153(c00) · source: NVD
BF
Bla-tl00b Firmware · Huawei
8.0.0.129(sp2c01) · source: NVD
CF
Charlotte-al00a Firmware · Huawei
8.1.0.176(c00) · source: NVD
CF
Charlotte-tl00b Firmware · Huawei
8.1.0.176(c01) · source: NVD
CF
Columbia-al10b Firmware · Huawei
8.1.0.163(c00) · source: NVD
CF
Columbia-al10i Firmware · Huawei
8.1.0.150(c675custc675d2) · source: NVD
CF
Columbia-l29d Firmware · Huawei
8.1.0.146(c461); 8.1.0.148(c185); 8.1.0.151(c10); 8.1.0.151(c432) · source: NVD
CF
Columbia-tl00d Firmware · Huawei
8.1.0.186(c01gt) · source: NVD
EF
Elle-al00b Firmware · Huawei
9.1.0.162(c00e160r2p1) · source: NVD
EF
Elle-tl00b Firmware · Huawei
9.1.0.162(c01e160r2p1) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-5235
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-5235
Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190821-01-smartphone-en
More from Alp-al00b Firmware
7.8
CVE-2019-2215
Android Kernel Use-After-Free Vulnerability
8.1
CVE-2019-9506
The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length…
6.8
CVE-2018-7910
Some Huawei smartphones ALP-AL00B 8.0.0.118D(C00), ALP-TL00B 8.0.0.118D(C01), BLA-AL00B 8.0.0.118D(C00), BLA-L09C 8.0.0.127(C432), 8.0.0.128(C432), 8.0.0.137(C432), BLA-L29C…
5.3
CVE-2019-5303
There are two denial of service vulnerabilities on some Huawei smartphones
5.3
CVE-2019-5302
There are two denial of service vulnerabilities on some Huawei smartphones