CVE-2019-5225

HIGH
7.8
CVSS Score
Published: November 29, 2019 at 07:01 PM UTC
Updated: June 17, 2026 at 02:37 AM UTC
6 products affected across 1 vendorP30 FirmwareMate 20 FirmwareP30 Pro Firmware

Using P30, Mate 20, P30 Pro by N/A?

Get instant alerts when new vulnerabilities affect P30, Mate 20, P30 Pro - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.8%

Description

P30, Mate 20, P30 Pro smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), versions earlier than Hima-AL00B 9.1.0.135(C00E200R2P1), versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R1P12) have a buffer overflow vulnerability on several , the system does not properly validate certain length parameter which an application transports to kernel. An attacker tricks the user to install a malicious application, successful exploit could cause malicious code execution.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v < hima-al00b_9.1.0.135(c00e200r2p1)
Affected range stops below hima-al00b_9.1.0.135(c00e200r2p1), so it looks safe — our inference, not a vendor statement
huawei-mate-20 (same device)
v < elle-al00b_9.1.0.193(c00e190r1p21)
Affected range stops below elle-al00b_9.1.0.193(c00e190r1p21), so it looks safe — our inference, not a vendor statement
huawei-p30 (same device)
v < vogue-al00a_9.1.0.193(c00e190r1p12)
Affected range stops below vogue-al00a_9.1.0.193(c00e190r1p12), so it looks safe — our inference, not a vendor statement
huawei-p30-pro (same device)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-120

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card