Main Vulnerability Database Vulnerabilities #VU22779

Improper Authentication in Huawei Band 2 and Honor Band 3 - CVE-2019-5218

Published: November 14, 2019

Vulnerability identifier: #VU22779

CSH Severity: Low

CVSS v4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-5218

CWE-ID: CWE-287

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to bypass authentication process.

The vulnerability exists due to the band does not sufficiently authenticate the device try to connect to it in certain scenario. An attacker on adjacent network can fake certain credential, spoof the band, then connect to it and gain unauthorized access to the application.

Affected software

Huawei Band 2
Honor Band 3

How to mitigate CVE-2019-5218

Install updates from vendor's website.

Product Name	Affected Version	Resolved Product and Version
Huawei Band 2	Versions earlier than Eris-B19/Eris-B29 1.2.53	Eris-B19/Eris-B29 1.2.53
Honor Band 3	Versions earlier than NYX-B10HN 1.5.53	NYX-B10HN 1.5.53

Huawei Band 2 - update to 1.2.53
Honor Band 3 - update to 1.5.53

External References

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191106-01-band-en

Related Security Bulletins