CVE-2019-5250 Auth bypass in Mate 20 Pro

High 7.8 Published 13 Dec 2019 Updated 4 Aug 2024

Attackers can bypass student mode restrictions on Huawei Mate 20 Pro by tricking users into installing malicious apps before enabling the feature.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2019-5250?

CVE-2019-5250 is a high-severity authentication bypass vulnerability in Mate 20 Pro, published on 13 Dec 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Mate 20 Pro smartphones with versions earlier than 9.1.0.135(C00E133R3P1) have an improper authorization vulnerability. The software does not properly restrict certain operation of certain privilege, the attacker could trick the user into installing a malicious application before the user turns on student mode function. Successful exploit could allow the attacker to bypass the limit of student mode function.

Weakness: CWE-269

Which versions are affected by CVE-2019-5250?

It affects 1 product.

Products include Huawei Mate 20 Pro Firmware.

How do I fix CVE-2019-5250?

No fix has been published for CVE-2019-5250 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2019-5250 being exploited?

There is no known exploitation of CVE-2019-5250 in the wild and no public exploit code.

Sources

Also known as GHSA-35fq-rqch-cg5p.