A vulnerability classified as problematic has been found in Huawei P30 9.1.0.193(C00E190R2P1) (Smartphone Operating System). This affects an unknown code of the component Share Handler. The manipulation as part of a Access Message leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

Huawei Share function in P30 9.1.0.193(C00E190R2P1) smartphone has an improper access control vulnerability. The function incorrectly controls certain access messages, attackers can simulate a sender to steal P2P network information. Successful exploit may cause information leakage.

The weakness was disclosed 12/23/2019 (Website). It is possible to read the advisory at huawei.com. This vulnerability is uniquely identified as CVE-2019-5265 since 01/04/2019. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/24/2019). The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry VDB-147628 is pretty similar.

Productinfo

Type

• Smartphone Operating System

Vendor

• Huawei

Name

• P30

Version

• 9.1.0.193(C00E190R2P1)

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion