CVE-2019-5260: Input Validation
First published: Fri Dec 13 2019(Updated: )
Huawei smartphones HUAWEI Y9 2019 and Honor View 20 have a denial of service vulnerability. Due to insufficient input validation of specific value when parsing the messages, an attacker may send specially crafted TD-SCDMA messages from a rogue base station to the affected devices to exploit this vulnerability. Successful exploit may cause an infinite loop and the device to reboot.
Credit: psirt@huawei.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Huawei Y9 2019 Firmware | =8.2.0.160\(c185r2p2\) | |
| Huawei Y9 2019 Firmware | =8.2.0.162\(c605\) | |
| Huawei Y9 2019 Firmware | =8.2.0.163\(c605\) | |
| HUAWEI Y9 2019 | ||
| Huawei View 20 Firmware | =9.0.1.169\(c636e1r4p1\) | |
| Huawei View 20 Firmware | =9.0.1.170\(c185e2r3p1\) | |
| Huawei View 20 Firmware | =9.0.1.170\(c432e1r3p1\) | |
| Huawei View 20 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-5260.
Which Huawei smartphones are affected by this vulnerability?
The Huawei smartphones HUAWEI Y9 2019 and Honor View 20 are affected by this vulnerability.
What is the severity level of CVE-2019-5260?
The severity level of CVE-2019-5260 is medium with a score of 6.5.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by sending specially crafted TD-SCDMA messages from a rogue base station to the affected devices.
Is there a fix available for this vulnerability?
Yes, Huawei has released a security advisory with information on how to mitigate this vulnerability. You can find more information at the following link: [Huawei Security Advisory](https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190911-01-mobile-en)
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/event
- agent/weakness
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/huawei
- canonical/huawei y9 2019 firmware
- version/huawei y9 2019 firmware/8.2.0.160\(c185r2p2\)
- version/huawei y9 2019 firmware/8.2.0.162\(c605\)
- version/huawei y9 2019 firmware/8.2.0.163\(c605\)
- canonical/huawei y9 2019
- canonical/huawei view 20 firmware
- version/huawei view 20 firmware/9.0.1.169\(c636e1r4p1\)
- version/huawei view 20 firmware/9.0.1.170\(c185e2r3p1\)
- version/huawei view 20 firmware/9.0.1.170\(c432e1r3p1\)
- canonical/huawei view 20