Low severity · published Nov 13, 2019
CVE-2019-5292
Honor 10 Lite, Honor 8A, Huawei Y6 mobile phones with the versions before 9.1.0.217(C00E215R3P1), the versions before 9.1.0.205(C00E97R1P9), the versions before…
3.3
CVSS
0.2%
EPSS
No
On KEV
Description
Honor 10 Lite, Honor 8A, Huawei Y6 mobile phones with the versions before 9.1.0.217(C00E215R3P1), the versions before 9.1.0.205(C00E97R1P9), the versions before 9.1.0.205(C00E97R2P2) have an information leak vulnerability. Due to improper function error records of some module, an attacker with the access permission may exploit the vulnerability to obtain some information.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H1
Honor 10 Lite Firmware · Huawei
before 9.1.0.217\(c00e215r3p1\) · source: NVD
H8
Honor 8a Firmware · Huawei
before 9.1.0.205\(c00e97r1p9\) · source: NVD
HY
Huawei Y6 Firmware · Huawei
before 9.1.0.205\(c00e97r2p2\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-5292
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-5292
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-phone-en
More from Honor 10 Lite Firmware
6.5
CVE-2020-9069
There is an information leakage vulnerability in some Huawei products
5.3
CVE-2019-5303
There are two denial of service vulnerabilities on some Huawei smartphones
5.3
CVE-2019-5302
There are two denial of service vulnerabilities on some Huawei smartphones