Medium severity · published Jun 4, 2019
CVE-2019-5244
Mate 9 Pro Huawei smartphones earlier than LON-L29C 8.0.0.361(C636) versions have an information leak vulnerability due to the lack of input validation
5.5
CVSS
0.7%
EPSS
No
On KEV
Description
Mate 9 Pro Huawei smartphones earlier than LON-L29C 8.0.0.361(C636) versions have an information leak vulnerability due to the lack of input validation. An attacker tricks the user who has root privilege to install an application on the smart phone, and the application can read some process information, which may cause sensitive information leak.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
M9
Mate 9 Pro · Huawei
Earlier than LON-L29C 8.0.0.361(C636) versions · source: vendor
M9
Mate 9 Pro Fimware · Huawei
before lon-l29c_8.0.0.361\(c636\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-5244
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-5244
Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190220-01-informationleak-en
More from Mate 9 Pro
6.5
CVE-2017-17175
Short Message Service (SMS) module of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.354(C00) has a Denial of Service (DoS) vulnerability
4.6
CVE-2019-5217
There is an information disclosure vulnerability on Mate 9 Pro Huawei smartphones versions earlier than LON-AL00B9.0.1.150 (C00E61R1P8T8)