CVE-2019-5220 Auth bypass in Honor Magic 2
Attackers can bypass Factory Reset Protection on Huawei smartphones by exploiting insufficient permission verification during the setup wizard.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-5220?
CVE-2019-5220 is a medium-severity authentication bypass vulnerability in Huawei Honor Magic 2, published on 10 Jul 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones. The system does not sufficiently verify the permission, an attacker could do a certain operation on certain step of setup wizard. Successful exploit could allow the attacker bypass the FRP protection. Affected products: Mate 20 X, versions earlier than Ever-AL00B 9.0.0.200(C00E200R2P1); Mate 20, versions earlier than Hima-AL00B/Hima-TL00B 9.0.0.200(C00E200R2P1); Honor Magic 2, versions earlier than Tony-AL00B/Tony-TL00B 9.0.0.182(C00E180R2P2).
Weakness: CWE-863
Which versions are affected by CVE-2019-5220?
It affects 3 products.
Products include Huawei Honor Magic 2 Firmware, Huawei Mate 20 Firmware, Huawei Mate 20 X Firmware.
How do I fix CVE-2019-5220?
No fix has been published for CVE-2019-5220 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-5220 being exploited?
There is no known exploitation of CVE-2019-5220 in the wild and no public exploit code.
Other vulnerabilities in Huawei Honor Magic 2
Sources
Also known as GHSA-xv59-3gpf-c92h.