There is a man-in-the-middle (MITM) vulnerability on Huawei P30 smartphones versions…
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
There is a man-in-the-middle (MITM) vulnerability on Huawei P30 smartphones versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1), and P30 Pro versions before VOG-AL00 9.1.0.162 (C01E160R1P12/C01E160R2P1). When users establish connection and transfer data through Huawei Share, an attacker could sniff, spoof and do a series of operations to intrude the Huawei Share connection and launch a man-in-the-middle attack to obtain and tamper the data. (Vulnerability ID: HWPSIRT-2019-03109)
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Huawei | P30,P30 Pro | The versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1); The versions before VOG-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) | — | No fix listed | CNA |
- P30,P30 Pro VendorHuawei Affected The versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1); The versions before VOG-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:p30_pro_firmware:*:*:*:*:*:*:*:* | before vog-al00_9.1.0.162\(c01e160r1p12\/c01e160r2p1\) | Vulnerable | Huawei |
| cpe:2.3:h:huawei:p30_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:p30_firmware:*:*:*:*:*:*:*:* | before ele-al00_9.1.0.162\(c01e160r1p12\/c01e160r2p1\) | Vulnerable | Huawei |
| cpe:2.3:h:huawei:p30:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
- cpe:2.3:o:huawei:p30_pro_firmware:*:*:*:*:*:*:*:* Versions before vog-al00_9.1.0.162\(c01e160r1p12\/c01e160r2p1\) Vulnerable ·Huawei
- cpe:2.3:h:huawei:p30_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:p30_firmware:*:*:*:*:*:*:*:* Versions before ele-al00_9.1.0.162\(c01e160r1p12\/c01e160r2p1\) Vulnerable ·Huawei
- cpe:2.3:h:huawei:p30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-5215
- 2026-10-03 Alias added: GHSA-rcwg-4gj2-4r2g
References
More Huawei P30 Firmware vulnerabilities
- TI-2020-00021 In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write… CVSS 3.1HIGH 8.8
- TI-2019-06941 Cryptographic flaw in Bluetooth BR/EDR CVSS 3.1HIGH 8.1
- TI-2020-07404 Use after free in HUAWEI Mate 30;HUAWEI P30 CVSS 3.1HIGH 7.8
- TI-2020-07388 Buffer overflow in Huawei HONOR 20 PRO CVSS 3.1HIGH 7.8
- TI-2019-03717 Integer overflow in P30 CVSS 3.1HIGH 7.8
- TI-2019-03716 Integer overflow in P30 CVSS 3.1HIGH 7.8
Sources
- CVE-2019-5215 · CVE Program
- CVE-2019-5215 · NVD
- FIRST EPSS
- GHSA-rcwg-4gj2-4r2g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences