FKIE_CVE-2019-5260

Vulnerability from fkie_nvd - Published: 2019-12-13 22:15 - Updated: 2026-06-17 02:37
Severity
6.5 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Huawei smartphones HUAWEI Y9 2019 and Honor View 20 have a denial of service vulnerability. Due to insufficient input validation of specific value when parsing the messages, an attacker may send specially crafted TD-SCDMA messages from a rogue base station to the affected devices to exploit this vulnerability. Successful exploit may cause an infinite loop and the device to reboot.
References
psirt@huawei.comhttps://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190911-01-mobile-enVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190911-01-mobile-enVendor Advisory
Impacted products
Vendor Product Version
huawei y9_2019_firmware 8.2.0.160\(c185r2p2\)
huawei y9_2019_firmware 8.2.0.162\(c605\)
huawei y9_2019_firmware 8.2.0.163\(c605\)
huawei y9_2019 -
huawei view_20_firmware 9.0.1.169\(c636e1r4p1\)
huawei view_20_firmware 9.0.1.170\(c185e2r3p1\)
huawei view_20_firmware 9.0.1.170\(c432e1r3p1\)
huawei view_20 -
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "HUAWEI Y9 2019;Honor View 20",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0.160(C185R2P2)"
            },
            {
              "status": "affected",
              "version": "8.2.0.162(C605)"
            },
            {
              "status": "affected",
              "version": "8.2.0.163(C605)"
            },
            {
              "status": "affected",
              "version": "9.0.1.169(C636E1R4P1)"
            },
            {
              "status": "affected",
              "version": "9.0.1.170(C185E2R3P1)"
            },
            {
              "status": "affected",
              "version": "9.0.1.170(C432E1R3P1)"
            }
          ]
        }
      ],
      "source": "psirt@huawei.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:y9_2019_firmware:8.2.0.160\\(c185r2p2\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "1624626A-F8A0-4913-BEC5-F980E97151B5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:huawei:y9_2019_firmware:8.2.0.162\\(c605\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "2D6FCB56-EC4B-4BCD-BC6B-AA00B2958309",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:huawei:y9_2019_firmware:8.2.0.163\\(c605\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "64A2B0BA-61C6-4B57-B5F4-C6D0BA0DD5C9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:y9_2019:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F48ABE15-BC87-4B02-8B39-94DA1DC96B92",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:view_20_firmware:9.0.1.169\\(c636e1r4p1\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "4809DED6-BA3A-4BCE-B16F-4B8A3069DDEC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:huawei:view_20_firmware:9.0.1.170\\(c185e2r3p1\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "A43A0E55-2963-4B8B-ADA9-4E460B033004",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:huawei:view_20_firmware:9.0.1.170\\(c432e1r3p1\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "73E31C10-643A-4E2C-BBA6-108DAF3D1D6A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:view_20:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "602512EA-74A4-4102-B27F-873E18278756",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Huawei smartphones HUAWEI Y9 2019 and Honor View 20 have a denial of service vulnerability. Due to insufficient input validation of specific value when parsing the messages, an attacker may send specially crafted TD-SCDMA messages from a rogue base station to the affected devices to exploit this vulnerability. Successful exploit may cause an infinite loop and the device to reboot."
    },
    {
      "lang": "es",
      "value": "Los tel\u00e9fonos inteligentes Huawei HUAWEI Y9 2019 y Honor View 20, tienen una vulnerabilidad de denegaci\u00f3n de servicio. Debido a una comprobaci\u00f3n de entrada insuficiente de un valor espec\u00edfico cuando se analizan los mensajes, un atacante puede enviar mensajes TD-SCDMA especialmente dise\u00f1ados desde una estaci\u00f3n base no autorizada hacia los dispositivos afectados para explotar esta vulnerabilidad. La explotaci\u00f3n con \u00e9xito puede causar un bucle infinito y reiniciar el dispositivo."
    }
  ],
  "id": "CVE-2019-5260",
  "lastModified": "2026-06-17T02:37:23.927",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "ADJACENT_NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 6.1,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 6.5,
        "impactScore": 6.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-12-13T22:15:11.687",
  "references": [
    {
      "source": "psirt@huawei.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190911-01-mobile-en"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190911-01-mobile-en"
    }
  ],
  "sourceIdentifier": "psirt@huawei.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.