Details of VAR-202006-0752

ID

VAR-202006-0752

CVE

CVE-2019-19412

TITLE

plural Huawei Vulnerabilities in smartphones

Trust: 0.8

sources: JVNDB: JVNDB-2019-015648

DESCRIPTION

Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker login the Talkback mode and can perform some operations to install a third-Party application. Affected products can be found in https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-frp-en. plural Huawei There are unspecified vulnerabilities in smartphones.Information may be tampered with

Trust: 1.62

sources: NVD: CVE-2019-19412 // JVNDB: JVNDB-2019-015648

AFFECTED PRODUCTS

vendor:	huawei	model:	leland-l21a	scope:	lt	version:	8.0.0.135\(c185\)	Trust: 1.0
vendor:	huawei	model:	emily-l29c	scope:	lt	version:	9.0.0.159\(c185e2r1p12t8\)	Trust: 1.0
vendor:	huawei	model:	florida-l21	scope:	lt	version:	8.0.0.131\(c432\)	Trust: 1.0
vendor:	huawei	model:	nova 3e	scope:	lt	version:	8.0.0.160\(c605\)	Trust: 1.0
vendor:	huawei	model:	figo-l03	scope:	lt	version:	9.1.0.130\(c605e6r1p5t8\)	Trust: 1.0
vendor:	huawei	model:	p20 lite	scope:	lt	version:	8.0.0.148\(c635\)	Trust: 1.0
vendor:	huawei	model:	bla-al00b	scope:	lt	version:	9.0.0.181\(c00e88r2p15t8\)	Trust: 1.0
vendor:	huawei	model:	p20 lite	scope:	lt	version:	8.0.0.155\(c605\)	Trust: 1.0
vendor:	huawei	model:	nova 3e	scope:	lt	version:	8.0.0.168\(c432\)	Trust: 1.0
vendor:	huawei	model:	p20 lite	scope:	lt	version:	8.0.0.160\(c605\)	Trust: 1.0
vendor:	huawei	model:	florida-l23	scope:	lt	version:	8.0.0.144\(c605\)	Trust: 1.0
vendor:	huawei	model:	y7s	scope:	lt	version:	9.1.0.124\(c636e6r1p5t8\)	Trust: 1.0
vendor:	huawei	model:	emily-l29c	scope:	lt	version:	9.0.0.165\(c605e2r1p12\)	Trust: 1.0
vendor:	huawei	model:	p20 lite	scope:	lt	version:	8.0.0.157\(c432\)	Trust: 1.0
vendor:	huawei	model:	nova 3e	scope:	lt	version:	8.0.0.172\(c636\)	Trust: 1.0
vendor:	huawei	model:	p20 lite	scope:	lt	version:	8.0.0.168\(c432\)	Trust: 1.0
vendor:	huawei	model:	nova 3e	scope:	lt	version:	8.0.0.147\(c461\)	Trust: 1.0
vendor:	huawei	model:	alp-l29	scope:	lt	version:	9.0.0.177\(c185e2r1p12t8\)	Trust: 1.0
vendor:	huawei	model:	florida-l21	scope:	lt	version:	8.0.0.132\(c185\)	Trust: 1.0
vendor:	huawei	model:	nova 3e	scope:	lt	version:	8.0.0.160\(c185\)	Trust: 1.0
vendor:	huawei	model:	emily-l29c	scope:	lt	version:	9.0.0.168\(c636e7r1p13t8\)	Trust: 1.0
vendor:	huawei	model:	p20 lite	scope:	lt	version:	8.0.0.172\(c636\)	Trust: 1.0
vendor:	huawei	model:	alp-l09	scope:	lt	version:	9.0.0.201\(c432e4r1p9\)	Trust: 1.0
vendor:	huawei	model:	alp-l29	scope:	lt	version:	9.0.0.195\(c636e2r1p12\)	Trust: 1.0
vendor:	huawei	model:	figo-l21	scope:	lt	version:	9.1.0.130\(c635e6r1p5t8\)	Trust: 1.0
vendor:	huawei	model:	berkeley-l09	scope:	lt	version:	8.0.0.172\(c432\)	Trust: 1.0
vendor:	huawei	model:	p20 lite	scope:	lt	version:	8.0.0.156\(c605\)	Trust: 1.0
vendor:	huawei	model:	p20 lite	scope:	lt	version:	8.0.0.147\(c461\)	Trust: 1.0
vendor:	huawei	model:	p20 lite	scope:	lt	version:	8.0.0.155\(c185\)	Trust: 1.0
vendor:	huawei	model:	p20 lite	scope:	lt	version:	8.0.0.160\(c185\)	Trust: 1.0
vendor:	huawei	model:	leland-l22c	scope:	lt	version:	9.1.0.118\(c636e4r1p1t8\)	Trust: 1.0
vendor:	huawei	model:	alp-al00b	scope:	lt	version:	9.0.0.181\(c00e87r2p20t8\)	Trust: 1.0
vendor:	huawei	model:	florida-l21	scope:	lt	version:	8.0.0.129\(c605\)	Trust: 1.0
vendor:	huawei	model:	figo-l31	scope:	lt	version:	9.1.0.130\(c432e8r1p5t8\)	Trust: 1.0
vendor:	huawei	model:	berkeley-al20	scope:	lt	version:	9.0.0.156\(c00e156r2p14t8\)	Trust: 1.0
vendor:	huawei	model:	bla-l29c	scope:	lt	version:	9.0.0.206\(c432e4r1p11\)	Trust: 1.0
vendor:	huawei	model:	bla-l29c	scope:	lt	version:	9.0.0.210\(c635e4r1p13\)	Trust: 1.0
vendor:	huawei	model:	leland-al00a	scope:	lt	version:	8.0.0.182\(c00\)	Trust: 1.0
vendor:	huawei	model:	anne-al00	scope:	lt	version:	8.0.0.168\(c00\)	Trust: 1.0
vendor:	huawei	model:	emily-l29c	scope:	lt	version:	9.0.0.168\(c782e3r1p11t8\)	Trust: 1.0
vendor:	huawei	model:	p smart	scope:	lt	version:	9.1.0.130\(c605e6r1p5t8\)	Trust: 1.0
vendor:	huawei	model:	leland-l22a	scope:	lt	version:	9.1.0.118\(c636e4r1p1t8\)	Trust: 1.0
vendor:	huawei	model:	bla-l29c	scope:	lt	version:	9.0.0.179\(c576e2r1p7t8\)	Trust: 1.0
vendor:	huawei	model:	nova 3e	scope:	lt	version:	8.0.0.148\(zafc185\)	Trust: 1.0
vendor:	huawei	model:	bla-l09c	scope:	lt	version:	9.0.0.206\(c432e4r1p11\)	Trust: 1.0
vendor:	huawei	model:	emily-l29c	scope:	lt	version:	9.0.0.159\(c461e2r1p11t8\)	Trust: 1.0
vendor:	huawei	model:	florida-l03	scope:	lt	version:	9.1.0.121\(c605e5r1p1t8\)	Trust: 1.0
vendor:	huawei	model:	emily-l29c	scope:	lt	version:	9.0.0.196\(c635e2r1p11t8\)	Trust: 1.0
vendor:	huawei	model:	figo-l23	scope:	lt	version:	9.1.0.130\(c605e6r1p5t8\)	Trust: 1.0
vendor:	huawei	model:	florida-l22	scope:	lt	version:	8.0.0.132\(c636\)	Trust: 1.0
vendor:	huawei	model:	bla-l09c	scope:	lt	version:	9.0.0.177\(c185e2r1p13t8\)	Trust: 1.0
vendor:	huawei	model:	bla-l29c	scope:	lt	version:	9.0.0.194\(c185e2r1p13\)	Trust: 1.0
vendor:	huawei	model:	p smart	scope:	lt	version:	9.1.0.130\(c185e6r1p5t8\)	Trust: 1.0
vendor:	huawei	model:	emily-l29c	scope:	lt	version:	9.0.0.160\(c432e7r1p11t8\)	Trust: 1.0
vendor:	huawei	model:	p20 lite	scope:	lt	version:	8.0.0.148\(zafc185\)	Trust: 1.0
vendor:	huawei	model:	honor view 10	scope:	lt	version:	9.0.0.202\(c567e6r1p12t8\)	Trust: 1.0
vendor:	huawei	model:	leland-l31a	scope:	lt	version:	8.0.0.139\(c432\)	Trust: 1.0
vendor:	huawei	model:	leland-l21a	scope:	lt	version:	9.1.0.118\(c636e4r1p1t8\)	Trust: 1.0
vendor:	huawei	model:	berkeley-l09	scope:	lt	version:	8.0.0.173\(c636\)	Trust: 1.0
vendor:	huawei	model:	figo-l21	scope:	lt	version:	9.1.0.130\(c185e6r1p5t8\)	Trust: 1.0
vendor:	huawei	model:	p smart	scope:	lt	version:	9.1.0.124\(c636e6r1p5t8\)	Trust: 1.0
vendor:	huawei	model:	alp-al00b	scope:	eq	version:	9.0.0.181(c00e87r2p20t8)	Trust: 0.8
vendor:	huawei	model:	alp-l09	scope:	eq	version:	9.0.0.201(c432e4r1p9)	Trust: 0.8
vendor:	huawei	model:	alp-l29	scope:	eq	version:	9.0.0.177(c185e2r1p12t8)	Trust: 0.8
vendor:	huawei	model:	alp-l29	scope:	eq	version:	9.0.0.195(c636e2r1p12)	Trust: 0.8
vendor:	huawei	model:	anne-al00	scope:	eq	version:	8.0.0.168(c00)	Trust: 0.8
vendor:	huawei	model:	bla-al00b	scope:	eq	version:	9.0.0.181(c00e88r2p15t8)	Trust: 0.8
vendor:	huawei	model:	bla-l09c	scope:	eq	version:	9.0.0.177(c185e2r1p13t8)	Trust: 0.8
vendor:	huawei	model:	bla-l09c	scope:	eq	version:	9.0.0.206(c432e4r1p11)	Trust: 0.8
vendor:	huawei	model:	bla-l29c	scope:	eq	version:	9.0.0.179(c576e2r1p7t8)	Trust: 0.8
vendor:	huawei	model:	bla-l29c	scope:	eq	version:	9.0.0.194(c185e2r1p13)	Trust: 0.8
vendor:	huawei	model:	bla-l29c	scope:	eq	version:	9.0.0.206(c432e4r1p11)	Trust: 0.8
vendor:	huawei	model:	bla-l29c	scope:	eq	version:	9.0.0.210(c635e4r1p13)	Trust: 0.8

sources: JVNDB: JVNDB-2019-015648 // NVD: CVE-2019-19412

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-19412
value:	MEDIUM
Trust: 1.0
NVD:	JVNDB-2019-015648
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202001-783
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2019-19412
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:N/I:P/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2019-015648
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:N/I:P/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

nvd@nist.gov:	CVE-2019-19412
baseSeverity:	MEDIUM
baseScore:	4.6
vectorString:	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	PHYSICAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	0.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	JVNDB-2019-015648
baseSeverity:	MEDIUM
baseScore:	4.6
vectorString:	CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	PHYSICAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2019-015648 // CNNVD: CNNVD-202001-783 // NVD: CVE-2019-19412

PROBLEMTYPE DATA

problemtype:

NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2019-19412

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202001-783

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-015648

PATCH

title:	huawei-sa-20200115-01-frp	url:	https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-frp-en	Trust: 0.8
title:	Multiple Huawei Product security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=107111	Trust: 0.6

sources: JVNDB: JVNDB-2019-015648 // CNNVD: CNNVD-202001-783

EXTERNAL IDS

db:	NVD	id:	CVE-2019-19412	Trust: 2.4
db:	JVNDB	id:	JVNDB-2019-015648	Trust: 0.8
db:	CNNVD	id:	CNNVD-202001-783	Trust: 0.6

sources: JVNDB: JVNDB-2019-015648 // CNNVD: CNNVD-202001-783 // NVD: CVE-2019-19412

REFERENCES

url:	https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-frp-en	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2019-19412	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-19412	Trust: 0.8
url:	https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20200115-01-frp-cn	Trust: 0.6

sources: JVNDB: JVNDB-2019-015648 // CNNVD: CNNVD-202001-783 // NVD: CVE-2019-19412

CREDITS

The vulnerability was discovered by Huawei internal testing.

Trust: 0.6

sources: CNNVD: CNNVD-202001-783

SOURCES

db:	JVNDB	id:	JVNDB-2019-015648
db:	CNNVD	id:	CNNVD-202001-783
db:	NVD	id:	CVE-2019-19412

LAST UPDATE DATE

2024-11-23T22:11:28.102000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2019-015648	date:	2020-07-02T00:00:00
db:	CNNVD	id:	CNNVD-202001-783	date:	2021-01-05T00:00:00
db:	NVD	id:	CVE-2019-19412	date:	2024-11-21T04:34:43.503

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2019-015648	date:	2020-07-02T00:00:00
db:	CNNVD	id:	CNNVD-202001-783	date:	2020-01-15T00:00:00
db:	NVD	id:	CVE-2019-19412	date:	2020-06-08T19:15:10.517