CVE-2019-19412
MEDIUM
4.6
CVSS Score
Published: June 8, 2020 at 06:21 PM UTC
Updated: June 17, 2026 at 02:26 AM UTC
56 products affected across 1 vendorAlp AL00B FirmwareBerkeley L09 FirmwareEmily L29C Firmware
Using ALP-AL00B by Huawei?
Get instant alerts when new vulnerabilities affect ALP-AL00B - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM4.6
Exploit prediction
EPSS 0.2%
Description
Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker login the Talkback mode and can perform some operations to install a third-Party application. Affected products can be found in https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-frp-en.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v < 9.0.0.181(c00e87r2p20t8)
Affected range stops below 9.0.0.181(c00e87r2p20t8), so it looks safe — our inference, not a vendor statement
huawei-alp-al00b (same device)
v < 9.0.0.201v < 9.0.0.201(c432e4r1p9)
Affected range stops below 9.0.0.201, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.0.0.201(c432e4r1p9), so it looks safe — our inference, not a vendor statement
huawei-alp-l09 (same device)
v < 9.0.0.177v < 9.0.0.177(c185e2r1p12t8)v < 9.0.0.195v < 9.0.0.195(c636e2r1p12)
Affected range stops below 9.0.0.177, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.0.0.177(c185e2r1p12t8), so it looks safe — our inference, not a vendor statement
Affected range stops below 9.0.0.195, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.0.0.195(c636e2r1p12), so it looks safe — our inference, not a vendor statement
huawei-alp-l29 (same device)
v < 8.0.0.168v < 8.0.0.168(c00)
Affected range stops below 8.0.0.168, so it looks safe — our inference, not a vendor statement
Affected range stops below 8.0.0.168(c00), so it looks safe — our inference, not a vendor statement
huawei-anne-al00 (same device)
v < 9.0.0.156v < 9.0.0.156(c00e156r2p14t8)
Affected range stops below 9.0.0.156, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.0.0.156(c00e156r2p14t8), so it looks safe — our inference, not a vendor statement
huawei-berkeley-al20 (same device)
v < 8.0.0.172(c432)v < 8.0.0.173(c636)
Affected range stops below 8.0.0.172(c432), so it looks safe — our inference, not a vendor statement
Affected range stops below 8.0.0.173(c636), so it looks safe — our inference, not a vendor statement
huawei-berkeley-l09 (same device)
v < 9.0.0.181(c00e88r2p15t8)
Affected range stops below 9.0.0.181(c00e88r2p15t8), so it looks safe — our inference, not a vendor statement
huawei-bla-al00b (same device)
v < 9.0.0.177(c185e2r1p13t8)v < 9.0.0.206(c432e4r1p11)
Affected range stops below 9.0.0.177(c185e2r1p13t8), so it looks safe — our inference, not a vendor statement
Affected range stops below 9.0.0.206(c432e4r1p11), so it looks safe — our inference, not a vendor statement
huawei-bla-l09c (same device)
v < 9.0.0.179(c576e2r1p7t8)v < 9.0.0.194(c185e2r1p13)v < 9.0.0.206(c432e4r1p11)v < 9.0.0.210(c635e4r1p13)
Affected range stops below 9.0.0.179(c576e2r1p7t8), so it looks safe — our inference, not a vendor statement
Affected range stops below 9.0.0.194(c185e2r1p13), so it looks safe — our inference, not a vendor statement
Affected range stops below 9.0.0.206(c432e4r1p11), so it looks safe — our inference, not a vendor statement
Affected range stops below 9.0.0.210(c635e4r1p13), so it looks safe — our inference, not a vendor statement
huawei-bla-l29c (same device)
v < 9.0.0.159(c185e2r1p12t8)v < 9.0.0.159(c461e2r1p11t8)v < 9.0.0.160(c432e7r1p11t8)v < 9.0.0.165(c605e2r1p12)v < 9.0.0.168(c636e7r1p13t8)v < 9.0.0.168(c782e3r1p11t8)v < 9.0.0.196(c635e2r1p11t8)
Affected range stops below 9.0.0.159(c185e2r1p12t8), so it looks safe — our inference, not a vendor statement
Affected range stops below 9.0.0.159(c461e2r1p11t8), so it looks safe — our inference, not a vendor statement
Affected range stops below 9.0.0.160(c432e7r1p11t8), so it looks safe — our inference, not a vendor statement
Affected range stops below 9.0.0.165(c605e2r1p12), so it looks safe — our inference, not a vendor statement
Affected range stops below 9.0.0.168(c636e7r1p13t8), so it looks safe — our inference, not a vendor statement
Affected range stops below 9.0.0.168(c782e3r1p11t8), so it looks safe — our inference, not a vendor statement
Affected range stops below 9.0.0.196(c635e2r1p11t8), so it looks safe — our inference, not a vendor statement
huawei-emily-l29c (same device)
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (1)
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-frp-enCVSS
- Attack Vector
- PHYSICAL
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- HIGH
- Availability
- NONE
Vector?
Quick Info
StatusMODIFIED
CWE
NVD-CWE-noinfo
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card