CVE-2019-5300

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

There is a digital signature verification bypass vulnerability in AR1200, AR1200-S, AR150, AR160, AR200, AR2200, AR2200-S, AR3200, SRG1300, SRG2300 and SRG3300 Huawei routers. The vulnerability is due to the affected software improperly verifying digital signatures for the software image in the affected device. A local attacker with high privilege may exploit the vulnerability to bypass integrity checks for software images and install a malicious software image on the affected device.

Metrics

CVSS 3.0 6.7/10CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
Huawei	AR1200, AR1200-S, AR150, AR160, AR200, AR2200, AR2200-S, AR3200, SRG1300, SRG2300, SRG3300	AR1200 V200R008C50; AR1200 V200R009C00; AR1200 V200R010C00; AR1200-S V200R007C00; AR1200-S V200R008C20; AR1200-S V200R008C50; AR1200-S V200R009C00; AR1200-S V200R010C00; AR150 V200R007C00; AR150 V200R008C20; AR150 V200R008C50; AR150 V200R009C00; AR150 V200R010C00; AR160 V200R007C00; AR160 V200R008C20; AR160 V200R008C50; AR160 V200R009C00

References

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190320-01-ar-enVendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190320-01-ar-enVendor Advisory

Timeline

Published: Jun 4, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-53013.3Huawei smart phones Honor V20 with the versions before 9.0.1.161(C00E161R2P2) have an information leak vulnerability. An attacker may trick CVE-2019-53025.3There are two denial of service vulnerabilities on some Huawei smartphones. An attacker may send specially crafted TD-SCDMA messages from a CVE-2019-53035.3There are two denial of service vulnerabilities on some Huawei smartphones. An attacker may send specially crafted TD-SCDMA messages from a CVE-2019-53047.5Some Huawei products have a buffer error vulnerability. An unauthenticated, remote attacker could send specific MPLS Echo Request messages t CVE-2019-53055.5The image processing module of some Huawei Mate 10 smartphones versions before ALP-L29 9.0.0.159(C185) has a memory double free vulnerabilit CVE-2019-53064.6There is a Factory Reset Protection (FRP) bypass security vulnerability in P20 Huawei smart phones versions before Emily-AL00A 9.0.0.167(C00 CVE-2019-53074.2Some Huawei 4G LTE devices, P30 versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) and P30 Pro versions before VOG-AL00 9.1.0.162(CVE-2019-53082.4Mate 20 RS smartphones with versions earlier than 9.1.0.135(C786E133R3P1) have an improper authorization vulnerability. The software does no CVE-2019-53094.6Honor play smartphones with versions earlier than 9.1.0.333(C00E333R1P1T8) have an information disclosure vulnerability in certain Huawei . CVE-2019-53106.1YUNUCMS 1.1.8 has XSS in app/admin/controller/System.php because crafted data can be written to the sys.php file, as demonstrated by site_ti CVE-2019-53116.1An issue was discovered in YUNUCMS V1.1.8. app/index/controller/Show.php has an XSS vulnerability via the index.php/index/show/index cw para CVE-2019-53129.8An issue was discovered in weixin-java-tools v3.3.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file.