CVE-2019-19412
Medium
Description
Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker login the Talkback mode and can perform some operations to install a third-Party application. Affected products can be found in https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-frp-en.
SeverityMedium
CVSS4.6
Exploit probability—
ProductHuawei Alp-al00b Firmware
PublishedJun 8, 2020
First seenJun 8, 2020
How to fix
Update
- huawei alp-al00b_firmware9.0.0.181\(c00e87r2p20t8\) or later
- huawei alp-l09_firmware9.0.0.201\(c432e4r1p9\) or later
- huawei alp-l29_firmware9.0.0.177\(c185e2r1p12t8\), 9.0.0.195\(c636e2r1p12\) or later
- huawei anne-al00_firmware8.0.0.168\(c00\) or later
- huawei bla-al00b_firmware9.0.0.181\(c00e88r2p15t8\) or later
- huawei bla-l09c_firmware9.0.0.177\(c185e2r1p13t8\), 9.0.0.206\(c432e4r1p11\) or later
- huawei bla-l29c_firmware9.0.0.179\(c576e2r1p7t8\), 9.0.0.194\(c185e2r1p13\), 9.0.0.206\(c432e4r1p11\), 9.0.0.210\(c635e4r1p13\) or later
- huawei berkeley-al20_firmware9.0.0.156\(c00e156r2p14t8\) or later
- huawei berkeley-l09_firmware8.0.0.172\(c432\), 8.0.0.173\(c636\) or later
- huawei emily-l29c_firmware9.0.0.159\(c185e2r1p12t8\), 9.0.0.159\(c461e2r1p11t8\), 9.0.0.160\(c432e7r1p11t8\), 9.0.0.165\(c605e2r1p12\), 9.0.0.168\(c636e7r1p13t8\), 9.0.0.168\(c782e3r1p11t8\), 9.0.0.196\(c635e2r1p11t8\) or later
- huawei figo-l03_firmware9.1.0.130\(c605e6r1p5t8\) or later
- huawei figo-l21_firmware9.1.0.130\(c185e6r1p5t8\), 9.1.0.130\(c635e6r1p5t8\) or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| huawei alp-al00b_firmware | v < 9.0.0.181\(c00e87r2p20t8\) | 9.0.0.181\(c00e87r2p20t8\) |
| huawei alp-l09_firmware | v < 9.0.0.201\(c432e4r1p9\) | 9.0.0.201\(c432e4r1p9\) |
| huawei alp-l29_firmware | v < 9.0.0.177\(c185e2r1p12t8\), v < 9.0.0.195\(c636e2r1p12\) | 9.0.0.177\(c185e2r1p12t8\), 9.0.0.195\(c636e2r1p12\) |
| huawei anne-al00_firmware | v < 8.0.0.168\(c00\) | 8.0.0.168\(c00\) |
| huawei bla-al00b_firmware | v < 9.0.0.181\(c00e88r2p15t8\) | 9.0.0.181\(c00e88r2p15t8\) |
| huawei bla-l09c_firmware | v < 9.0.0.177\(c185e2r1p13t8\), v < 9.0.0.206\(c432e4r1p11\) | 9.0.0.177\(c185e2r1p13t8\), 9.0.0.206\(c432e4r1p11\) |
| huawei bla-l29c_firmware | v < 9.0.0.179\(c576e2r1p7t8\), v < 9.0.0.194\(c185e2r1p13\), v < 9.0.0.206\(c432e4r1p11\), v < 9.0.0.210\(c635e4r1p13\) | 9.0.0.179\(c576e2r1p7t8\), 9.0.0.194\(c185e2r1p13\), 9.0.0.206\(c432e4r1p11\), 9.0.0.210\(c635e4r1p13\) |
| huawei berkeley-al20_firmware | v < 9.0.0.156\(c00e156r2p14t8\) | 9.0.0.156\(c00e156r2p14t8\) |
| huawei berkeley-l09_firmware | v < 8.0.0.172\(c432\), v < 8.0.0.173\(c636\) | 8.0.0.172\(c432\), 8.0.0.173\(c636\) |
| huawei emily-l29c_firmware | v < 9.0.0.159\(c185e2r1p12t8\), v < 9.0.0.159\(c461e2r1p11t8\), v < 9.0.0.160\(c432e7r1p11t8\), v < 9.0.0.165\(c605e2r1p12\), v < 9.0.0.168\(c636e7r1p13t8\), v < 9.0.0.168\(c782e3r1p11t8\), v < 9.0.0.196\(c635e2r1p11t8\) | 9.0.0.159\(c185e2r1p12t8\), 9.0.0.159\(c461e2r1p11t8\), 9.0.0.160\(c432e7r1p11t8\), 9.0.0.165\(c605e2r1p12\), 9.0.0.168\(c636e7r1p13t8\), 9.0.0.168\(c782e3r1p11t8\), 9.0.0.196\(c635e2r1p11t8\) |
| huawei figo-l03_firmware | v < 9.1.0.130\(c605e6r1p5t8\) | 9.1.0.130\(c605e6r1p5t8\) |
| huawei figo-l21_firmware | v < 9.1.0.130\(c185e6r1p5t8\), v < 9.1.0.130\(c635e6r1p5t8\) | 9.1.0.130\(c185e6r1p5t8\), 9.1.0.130\(c635e6r1p5t8\) |
| huawei figo-l23_firmware | v < 9.1.0.130\(c605e6r1p5t8\) | 9.1.0.130\(c605e6r1p5t8\) |
| huawei figo-l31_firmware | v < 9.1.0.130\(c432e8r1p5t8\) | 9.1.0.130\(c432e8r1p5t8\) |
| huawei florida-l03_firmware | v < 9.1.0.121\(c605e5r1p1t8\) | 9.1.0.121\(c605e5r1p1t8\) |
| huawei florida-l21_firmware | v < 8.0.0.129\(c605\), v < 8.0.0.131\(c432\), v < 8.0.0.132\(c185\) | 8.0.0.129\(c605\), 8.0.0.131\(c432\), 8.0.0.132\(c185\) |
| huawei florida-l22_firmware | v < 8.0.0.132\(c636\) | 8.0.0.132\(c636\) |
| huawei florida-l23_firmware | v < 8.0.0.144\(c605\) | 8.0.0.144\(c605\) |
| huawei p_smart_firmware | v < 9.1.0.130\(c185e6r1p5t8\), v < 9.1.0.130\(c605e6r1p5t8\), v < 9.1.0.124\(c636e6r1p5t8\) | 9.1.0.130\(c185e6r1p5t8\), 9.1.0.130\(c605e6r1p5t8\), 9.1.0.124\(c636e6r1p5t8\) |
| huawei y7s_firmware | v < 9.1.0.124\(c636e6r1p5t8\) | 9.1.0.124\(c636e6r1p5t8\) |
| huawei p20_lite_firmware | v < 8.0.0.148\(c635\), v < 8.0.0.155\(c185\), v < 8.0.0.155\(c605\), v < 8.0.0.156\(c605\), v < 8.0.0.157\(c432\), v < 8.0.0.147\(c461\), v < 8.0.0.148\(zafc185\), v < 8.0.0.160\(c185\), v < 8.0.0.160\(c605\), v < 8.0.0.168\(c432\), v < 8.0.0.172\(c636\) | 8.0.0.148\(c635\), 8.0.0.155\(c185\), 8.0.0.155\(c605\), 8.0.0.156\(c605\), 8.0.0.157\(c432\), 8.0.0.147\(c461\), 8.0.0.148\(zafc185\), 8.0.0.160\(c185\), 8.0.0.160\(c605\), 8.0.0.168\(c432\), 8.0.0.172\(c636\) |
| huawei nova_3e_firmware | v < 8.0.0.147\(c461\), v < 8.0.0.148\(zafc185\), v < 8.0.0.160\(c185\), v < 8.0.0.160\(c605\), v < 8.0.0.168\(c432\), v < 8.0.0.172\(c636\) | 8.0.0.147\(c461\), 8.0.0.148\(zafc185\), 8.0.0.160\(c185\), 8.0.0.160\(c605\), 8.0.0.168\(c432\), 8.0.0.172\(c636\) |
| huawei honor_view_10_firmware | v < 9.0.0.202\(c567e6r1p12t8\) | 9.0.0.202\(c567e6r1p12t8\) |
| huawei leland-al00a_firmware | v < 8.0.0.182\(c00\) | 8.0.0.182\(c00\) |
| huawei leland-l21a_firmware | v < 8.0.0.135\(c185\), v < 9.1.0.118\(c636e4r1p1t8\) | 8.0.0.135\(c185\), 9.1.0.118\(c636e4r1p1t8\) |
| huawei leland-l22a_firmware | v < 9.1.0.118\(c636e4r1p1t8\) | 9.1.0.118\(c636e4r1p1t8\) |
| huawei leland-l22c_firmware | v < 9.1.0.118\(c636e4r1p1t8\) | 9.1.0.118\(c636e4r1p1t8\) |
| huawei leland-l31a_firmware | v < 8.0.0.139\(c432\) | 8.0.0.139\(c432\) |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.