CVE-2019-5217 Auth bypass in Mate 9 Pro

Medium 4.6 Published 4 Jun 2019 Updated 4 Aug 2024

Attackers can view photos without unlocking the screen on Huawei Mate 9 Pro devices, leading to information disclosure.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-5217?

CVE-2019-5217 is a medium-severity authentication bypass vulnerability in Huawei Mate 9 Pro, published on 4 Jun 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

There is an information disclosure vulnerability on Mate 9 Pro Huawei smartphones versions earlier than LON-AL00B9.0.1.150 (C00E61R1P8T8). An attacker could view the photos after a series of operations without unlocking the screen lock. Successful exploit could cause an information disclosure condition.

Weakness: CWE-307

Which versions are affected by CVE-2019-5217?

It affects 1 product.

Products include Huawei Mate 9 Pro Firmware.

How do I fix CVE-2019-5217?

No fix has been published for CVE-2019-5217 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2019-5217 being exploited?

There is no known exploitation of CVE-2019-5217 in the wild and no public exploit code.

Sources

Also known as GHSA-f7wv-qp6p-3f43.