CVE-2019-5251
Medium
Description
There is a path traversal vulnerability in several Huawei smartphones. The system does not sufficiently validate certain pathnames from the application. An attacker could trick the user into installing, backing up and restoring a malicious application. Successful exploit could cause information disclosure.
SeverityMedium
CVSS5.5
Exploit probability—
ProductHuawei Honor V10 Firmware
PublishedDec 13, 2019
First seenDec 13, 2019
How to fix
Update
- huawei honor_v10_firmware9.1.0.333\(c00e333r2p1t8\) or later
- huawei p30_firmware9.1.0.226\(c00e220r2p1\) or later
- huawei enjoy_7s_firmware9.1.0.130\(c00e115r2p8t8\) or later
- huawei mate_20_firmware9.1.0.139\(c00e133r3p1\) or later
- huawei honor_9_lite_firmware9.1.0.143\(c636e5r1p5t8\), 9.1.0.130\(c00e112r2p10t8\) or later
- huawei honor_9i_firmware9.1.0.120\(c00e113r1p6t8\) or later
- huawei m6_firmware9.1.1.150\(c00e150r1p150\) or later
- huawei p30_pro_firmware9.1.0.226\(c00e210r2p1\) or later
- huawei honor_20s_firmware9.1.1.132\(c00e131r6p1\) or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| huawei honor_v10_firmware | v < 9.1.0.333\(c00e333r2p1t8\) | 9.1.0.333\(c00e333r2p1t8\) |
| huawei p30_firmware | v < 9.1.0.226\(c00e220r2p1\) | 9.1.0.226\(c00e220r2p1\) |
| huawei enjoy_7s_firmware | v < 9.1.0.130\(c00e115r2p8t8\) | 9.1.0.130\(c00e115r2p8t8\) |
| huawei mate_20_firmware | v < 9.1.0.139\(c00e133r3p1\) | 9.1.0.139\(c00e133r3p1\) |
| huawei honor_9_lite_firmware | v < 9.1.0.143\(c636e5r1p5t8\), v < 9.1.0.130\(c00e112r2p10t8\) | 9.1.0.143\(c636e5r1p5t8\), 9.1.0.130\(c00e112r2p10t8\) |
| huawei honor_9i_firmware | v < 9.1.0.120\(c00e113r1p6t8\) | 9.1.0.120\(c00e113r1p6t8\) |
| huawei m6_firmware | v < 9.1.1.150\(c00e150r1p150\) | 9.1.1.150\(c00e150r1p150\) |
| huawei p30_pro_firmware | v < 9.1.0.226\(c00e210r2p1\) | 9.1.0.226\(c00e210r2p1\) |
| huawei honor_20s_firmware | v < 9.1.1.132\(c00e131r6p1\) | 9.1.1.132\(c00e131r6p1\) |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.