High severity · published Dec 13, 2019
CVE-2019-5250
Mate 20 Pro smartphones with versions earlier than 9.1.0.135(C00E133R3P1) have an improper authorization vulnerability
7.8
CVSS
0.6%
EPSS
No
On KEV
Description
Mate 20 Pro smartphones with versions earlier than 9.1.0.135(C00E133R3P1) have an improper authorization vulnerability. The software does not properly restrict certain operation of certain privilege, the attacker could trick the user into installing a malicious application before the user turns on student mode function. Successful exploit could allow the attacker to bypass the limit of student mode function.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
M2
Mate 20 Pro Firmware · Huawei
before 9.1.0.135\(c00e133r3p1\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-5250
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-5250
Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-02-smartphone-en
More from Mate 20 Pro Firmware
8.8
CVE-2020-0022
In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation
7.8
CVE-2020-9080
There is an improper privilege management vulnerability in Huawei smart phone product
7.8
CVE-2020-9247
There is a buffer overflow vulnerability in several Huawei products
6.8
CVE-2020-9244
HUAWEI Mate 20 versions Versions earlier than 10.1.0.160(C00E160R3P8);HUAWEI Mate 20 Pro versions Versions earlier than 10.1.0.270(C431E7R1P5),Versions earlier than…
5.3
CVE-2019-5303
There are two denial of service vulnerabilities on some Huawei smartphones