#VU23396 Improper Authentication in Huawei products - CVE-2019-5252
Published: December 4, 2019
Vulnerability identifier: #VU23396
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2019-5252
CWE-ID: CWE-287
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Huawei Enjoy 8 Plus
Huawei Y9
Huawei Honor 8X
Huawei Honor 9 Lite
Huawei Honor 9i
Huawei Y6 Pro
Huawei Enjoy 8 Plus
Huawei Y9
Huawei Honor 8X
Huawei Honor 9 Lite
Huawei Honor 9i
Huawei Y6 Pro
Software vendor:
Huawei
Huawei
Description
The vulnerability allows an attacker to bypass authentication process.
The vulnerability exists due to the applock does not perform a sufficient authentication in a rare condition. An attacker with physical access to the device can use the application locked by applock in an instant when the phone's CPU is almost exhausted.
Remediation
Install updates from vendor's website.