CVE-2019-19412

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker login the Talkback mode and can perform some operations to install a third-Party application. Affected products can be found in https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-frp-en.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

VendorProductVersions
HuaweiALP-AL00Bearlier than 9.0.0.181(C00E87R2P20T8)
HuaweiALP-L09earlier than 9.0.0.201(C432E4R1P9)
HuaweiALP-L29earlier than 9.0.0.177(C185E2R1P12T8); earlier than 9.0.0.195(C636E2R1P12)
HuaweiAnne-AL00earlier than 8.0.0.168(C00)
HuaweiBLA-AL00Bearlier than 9.0.0.181(C00E88R2P15T8)
HuaweiBLA-L09Cearlier than 9.0.0.177(C185E2R1P13T8); earlier than 9.0.0.206(C432E4R1P11)
HuaweiBLA-L29Cearlier than 9.0.0.179(C576E2R1P7T8); earlier than 9.0.0.194(C185E2R1P13); earlier than 9.0.0.206(C432E4R1P11); earlier than 9.0.0.210(C635E4R1P13)
HuaweiBerkeley-AL20earlier than 9.0.0.156(C00E156R2P14T8)
HuaweiBerkeley-L09earlier than 8.0.0.172(C432); earlier than 8.0.0.173(C636)
HuaweiEmily-L29Cearlier than 9.0.0.159(C185E2R1P12T8); earlier than 9.0.0.159(C461E2R1P11T8); earlier than 9.0.0.160(C432E7R1P11T8); earlier than 9.0.0.165(C605E2R1P12); earlier than 9.0.0.168(C636E7R1P13T8); earlier than 9.0.0.168(C782E3R1P11T8); earlier than 9.0.0.196(C635E2R1P11T8)
HuaweiFigo-L03earlier than 9.1.0.130(C605E6R1P5T8)
HuaweiFigo-L21earlier than 9.1.0.130(C185E6R1P5T8); earlier than 9.1.0.130(C635E6R1P5T8)
HuaweiFigo-L23earlier than 9.1.0.130(C605E6R1P5T8)
HuaweiFigo-L31earlier than 9.1.0.130(C432E8R1P5T8)
HuaweiFlorida-L03earlier than 9.1.0.121(C605E5R1P1T8)
HuaweiFlorida-L21earlier than 8.0.0.129(C605); earlier than 8.0.0.131(C432); earlier than 8.0.0.132(C185)
HuaweiFlorida-L22earlier than 8.0.0.132(C636)
HuaweiFlorida-L23earlier than 8.0.0.144(C605)
HuaweiHUAWEI P smartearlier than 9.1.0.130(C185E6R1P5T8); earlier than 9.1.0.130(C605E6R1P5T8)
HuaweiHUAWEI P smart,HUAWEI Y7searlier than 9.1.0.124(C636E6R1P5T8)
HuaweiHUAWEI P20 liteearlier than 8.0.0.148(C635); earlier than 8.0.0.155(C185); earlier than 8.0.0.155(C605); earlier than 8.0.0.156(C605); earlier than 8.0.0.157(C432)
HuaweiHUAWEI nova 3e,HUAWEI P20 liteearlier than 8.0.0.147(C461); earlier than 8.0.0.148(ZAFC185); earlier than 8.0.0.160(C185); earlier than 8.0.0.160(C605); earlier than 8.0.0.168(C432); earlier than 8.0.0.172(C636)
HuaweiHonor View 10earlier than 9.0.0.202(C567E6R1P12T8)
HuaweiLeland-AL00Aearlier than 8.0.0.182(C00)
HuaweiLeland-L21Aearlier than 8.0.0.135(C185); earlier than 9.1.0.118(C636E4R1P1T8)
HuaweiLeland-L22Aearlier than 9.1.0.118(C636E4R1P1T8)
HuaweiLeland-L22Cearlier than 9.1.0.118(C636E4R1P1T8)
HuaweiLeland-L31Aearlier than 8.0.0.139(C432)

References

Timeline

Published
Jun 8, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-194137.5There is an integer overflow vulnerability in LDAP client of some Huawei products. Due to insufficient input validation, a remote attacker cCVE-2019-194147.5There is an integer overflow vulnerability in LDAP server of some Huawei products. Due to insufficient input validation, a remote attacker cCVE-2019-194157.5The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabiliCVE-2019-194167.5The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabiliCVE-2019-194177.5The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabiliCVE-2019-19426.5A vulnerability in the sponsor portal web interface for Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker tCVE-2019-19436.1A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Switches software could allow an unauthenticated, remoCVE-2019-19447.3Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, local atCVE-2019-194416.5HUAWEI P30 smart phones with versions earlier than 10.0.0.166(C00E66R1P11) have an information leak vulnerability. An attacker could send spCVE-2019-194477.8In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-freCVE-2019-194487.8In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs systeCVE-2019-194497.8In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manage
CVE-2019-19412: Medium severity, CVSS 4.6 | Vulnix