Improper Authentication in Huawei products - CVE-2019-5252

Vulnerability identifier: #VU23396

CSH Severity: Low

CVSS v4: 1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-5252

CWE-ID: CWE-287

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker to bypass authentication process.

The vulnerability exists due to the applock does not perform a sufficient authentication in a rare condition. An attacker with physical access to the device can use the application locked by applock in an instant when the phone's CPU is almost exhausted.

Huawei Enjoy 8 Plus
Huawei Y9
Huawei Honor 8X
Huawei Honor 9 Lite
Huawei Honor 9i
Huawei Y6 Pro

Install updates from vendor's website.

Huawei Enjoy 8 Plus - update to 9.1.0.124
Huawei Y9 - addressed in versions 9.1.0.131, 9.1.0.139
Huawei Honor 8X - addressed in versions 9.1.0.217, 9.1.0.237
Huawei Honor 9 Lite - addressed in versions 9.1.0.124, 9.1.0.136
Huawei Honor 9i - addressed in versions 9.1.0.115, 9.1.0.122
Huawei Y6 Pro - update to 9.1.0.248

• https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-smartphone-en

• Improper Authentication in several Huawei Smartphones