CVE-2019-5307
Description
Some Huawei 4G LTE devices, P30 versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) and P30 Pro versions before VOG-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1), are exposed to a message replay vulnerability. For the sake of better compatibility, these devices implement a less strict check on the NAS message sequence number (SN), specifically NAS COUNT. As a result, an attacker can construct a rogue base station and replay the GUTI reallocation command message in certain conditions to tamper with GUTIs, or replay the Identity request message to obtain IMSIs. (Vulnerability ID: HWPSIRT-2019-04107)
How to fix
- huawei p30_firmwareele-al00_9.1.0.162 or later
- huawei p30_pro_firmwarevog-al00_9.1.0.162 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| huawei p30_firmware | v < ele-al00_9.1.0.162 | ele-al00_9.1.0.162 |
| huawei p30_pro_firmware | v < vog-al00_9.1.0.162 | vog-al00_9.1.0.162 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.