VulnerabilityModified

CVE-2019-5244

Mate 9 Pro Huawei smartphones earlier than LON-L29C 8.0.0.361(C636) versions have an information leak vulnerability due to the lack of input validation.

MEDIUM 5.5EPSS 0.66%

Does this matter?

Lower severity and a low EPSS score (0.66%). Track it; it rarely justifies an emergency change on its own.

Description

Mate 9 Pro Huawei smartphones earlier than LON-L29C 8.0.0.361(C636) versions have an information leak vulnerability due to the lack of input validation. An attacker tricks the user who has root privilege to install an application on the smart phone, and the application can read some process information, which may cause sensitive information leak.

CVSS 3.0: 5.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS: 0.66% probability · 50th percentile
CISA KEV: Not listed
Weakness: CWE-20
Affected: huawei/mate 9 pro fimware
Source: psirt@huawei.com

References

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190220-01-informationleak-enVendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190220-01-informationleak-enVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.