Security Features in Huawei products - CVE-2019-19412

Vulnerability identifier: #VU24337

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-19412

CWE-ID: CWE-254

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to bypass the FRP function.

The vulnerability exists due to a Factory Reset Protection (FRP) security bypass. When re-configuring the mobile phone using the FRP function, an attacker with physical access to the device can login the Talkback mode, perform some operations to install a third-Party application and bypass the FRP function.

Huawei Figo-L23
Huawei Leland-L31A
Huawei Leland-L22C
Huawei Leland-L22A
Huawei Leland-L21A
Huawei Leland-AL00A
Huawei nova 3e
Huawei P20 lite
Huawei Y7s
Huawei Florida-L23
Huawei Florida-L22
Huawei Florida-L21
Huawei Florida-L03
Huawei Figo-L31
Huawei P-smart
Huawei Figo-L21
Huawei Figo-L03
Huawei Emily-L29C
Huawei Berkeley-L09
Huawei Berkeley-AL20
Huawei BLA-L29C
Huawei BLA-L09C
Huawei Anne-AL00
Huawei ALP-L29
Huawei ALP-L09
Huawei ALP-AL00B
Huawei Honor V10

Install updates from vendor's website.

Huawei Figo-L23 - update to 9.1.0.130
Huawei Leland-L31A - update to 8.0.0.139
Huawei Leland-L22C - update to 9.1.0.118
Huawei Leland-L22A - update to 9.1.0.118
Huawei Leland-L21A - addressed in versions 8.0.0.135, 9.1.0.118
Huawei Leland-AL00A - update to 8.0.0.182
Huawei nova 3e - addressed in versions 8.0.0.147, 8.0.0.160, 8.0.0.168, 8.0.0.172
Huawei P20 lite - addressed in versions 8.0.0.148, 8.0.0.155, 8.0.0.156, 8.0.0.157, 8.0.0.160, 8.0.0.168, 8.0.0.172
Huawei Y7s - update to 9.1.0.124
Huawei Florida-L23 - update to 8.0.0.144
Huawei Florida-L22 - update to 8.0.0.132
Huawei Florida-L21 - addressed in versions 8.0.0.129, 8.0.0.131, 8.0.0.132
Huawei Florida-L03 - update to 9.1.0.121
Huawei Figo-L31 - update to 9.1.0.130
Huawei P-smart - addressed in versions 9.1.0.124, 9.1.0.130
Huawei Figo-L21 - update to 9.1.0.130
Huawei Figo-L03 - update to 9.1.0.130
Huawei Emily-L29C - addressed in versions 9.0.0.159, 9.0.0.165, 9.0.0.168, 9.0.0.193
Huawei Berkeley-L09 - addressed in versions 8.0.0.172, 8.0.0.173
Huawei Berkeley-AL20 - update to 9.0.0.156
Huawei BLA-L29C - addressed in versions 9.0.0.194, 9.0.0.206, 9.0.0.210
Huawei BLA-L09C - addressed in versions 9.0.0.177, 9.0.0.206
Huawei Anne-AL00 - update to 8.0.0.168
Huawei ALP-L29 - addressed in versions 9.0.0.177, 9.0.0.195
Huawei ALP-L09 - update to 9.0.0.201
Huawei ALP-AL00B - update to 9.0.0.181
Huawei Honor V10 - update to 9.0.0.202

• https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-frp-en

• Factory Reset Protection (FRP) bypass in Huawei Smart Phones