« Volver al listado

CVE-2019-5260

Estado: ModificadaMedia (6.5)—

Huawei smartphones HUAWEI Y9 2019 and Honor View 20 have a denial of service vulnerability. Due to insufficient input validation of specific value when parsing the messages, an attacker may send specially crafted TD-SCDMA messages from a rogue base station to the affected devices to exploit this vulnerability. Successful exploit may cause an infinite loop and the device to reboot.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Huawei — View 20 FirmwareHuawei — Y9 2019 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-5260",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.1,
          "accessVector": "ADJACENT_NETWORK",
          "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.5,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@huawei.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "HUAWEI Y9 2019;Honor View 20",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0.160(C185R2P2)"
            },
            {
              "status": "affected",
              "version": "8.2.0.162(C605)"
            },
            {
              "status": "affected",
              "version": "8.2.0.163(C605)"
            },
            {
              "status": "affected",
              "version": "9.0.1.169(C636E1R4P1)"
            },
            {
              "status": "affected",
              "version": "9.0.1.170(C185E2R3P1)"
            },
            {
              "status": "affected",
              "version": "9.0.1.170(C432E1R3P1)"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-12-13T22:15:11.687",
  "references": [
    {
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190911-01-mobile-en",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@huawei.com"
    },
    {
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190911-01-mobile-en",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Huawei smartphones HUAWEI Y9 2019 and Honor View 20 have a denial of service vulnerability. Due to insufficient input validation of specific value when parsing the messages, an attacker may send specially crafted TD-SCDMA messages from a rogue base station to the affected devices to exploit this vulnerability. Successful exploit may cause an infinite loop and the device to reboot."
    },
    {
      "lang": "es",
      "value": "Los teléfonos inteligentes Huawei HUAWEI Y9 2019 y Honor View 20, tienen una vulnerabilidad de denegación de servicio. Debido a una comprobación de entrada insuficiente de un valor específico cuando se analizan los mensajes, un atacante puede enviar mensajes TD-SCDMA especialmente diseñados desde una estación base no autorizada hacia los dispositivos afectados para explotar esta vulnerabilidad. La explotación con éxito puede causar un bucle infinito y reiniciar el dispositivo."
    }
  ],
  "lastModified": "2026-06-17T02:37:23.927",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:y9_2019_firmware:8.2.0.160\\(c185r2p2\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1624626A-F8A0-4913-BEC5-F980E97151B5"
            },
            {
              "criteria": "cpe:2.3:o:huawei:y9_2019_firmware:8.2.0.162\\(c605\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D6FCB56-EC4B-4BCD-BC6B-AA00B2958309"
            },
            {
              "criteria": "cpe:2.3:o:huawei:y9_2019_firmware:8.2.0.163\\(c605\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64A2B0BA-61C6-4B57-B5F4-C6D0BA0DD5C9"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:y9_2019:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F48ABE15-BC87-4B02-8B39-94DA1DC96B92"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:view_20_firmware:9.0.1.169\\(c636e1r4p1\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4809DED6-BA3A-4BCE-B16F-4B8A3069DDEC"
            },
            {
              "criteria": "cpe:2.3:o:huawei:view_20_firmware:9.0.1.170\\(c185e2r3p1\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A43A0E55-2963-4B8B-ADA9-4E460B033004"
            },
            {
              "criteria": "cpe:2.3:o:huawei:view_20_firmware:9.0.1.170\\(c432e1r3p1\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "73E31C10-643A-4E2C-BBA6-108DAF3D1D6A"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:view_20:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "602512EA-74A4-4102-B27F-873E18278756"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@huawei.com"
}