CVE-2019-5283 Security feature bypass in P20
Attackers can bypass Factory Reset Protection on Huawei P20 devices by exploiting Talkback mode to access settings, circumventing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-5283?
CVE-2019-5283 is a medium-severity vulnerability in Huawei P20, published on 4 Jun 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
There is Factory Reset Protection (FRP) bypass security vulnerability in P20 Huawei smart phones versions earlier than Emily-AL00A 9.0.0.167 (C00E81R1P21T8). When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can login the Talkback mode and can perform some operations to access the setting page. As a result, the FRP function is bypassed.
Which versions are affected by CVE-2019-5283?
It affects 1 product.
Products include Huawei P20 Firmware.
How do I fix CVE-2019-5283?
No fix has been published for CVE-2019-5283 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-5283 being exploited?
There is no known exploitation of CVE-2019-5283 in the wild and no public exploit code.
Other vulnerabilities in Huawei P20
Sources
Also known as GHSA-7x8m-mfmh-6cjr.