Race condition in P30, P30 Pro, Honor V20
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
Certain detection module of P30, P30 Pro, Honor V20 smartphone whith Versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), Versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R1P12), Versions earlier than Princeton-AL10B 9.1.0.233(C00E233R4P3) have a race condition vulnerability. The system does not lock certain function properly, when the function is called by multiple processes could cause out of bound write. An attacker tricks the user into installing a malicious application, successful exploit could cause malicious code execution.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | P30, P30 Pro, Honor V20 | Versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), Versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R1P12), Versions earlier than Princeton-AL10B 9.1.0.233(C00E233R4P3) | — | No fix listed | CNA |
- P30, P30 Pro, Honor V20 Vendor— Affected Versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), Versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R1P12), Versions earlier than Princeton-AL10B 9.1.0.233(C00E233R4P3) Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:p30_firmware:*:*:*:*:*:*:*:* | before elle-al00b_9.1.0.193\(c00e190r1p21\) | Vulnerable | Huawei |
| cpe:2.3:h:huawei:p30:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:p30_pro_firmware:*:*:*:*:*:*:*:* | before vogue-al00a_9.1.0.193\(c00e190r1p12\) | Vulnerable | Huawei |
| cpe:2.3:h:huawei:p30_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:honor_v20_firmware:*:*:*:*:*:*:*:* | before princeton-al10b_9.1.0.233\(c00e233r4p3\) | Vulnerable | Huawei |
| cpe:2.3:h:huawei:honor_v20:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
- cpe:2.3:o:huawei:p30_firmware:*:*:*:*:*:*:*:* Versions before elle-al00b_9.1.0.193\(c00e190r1p21\) Vulnerable ·Huawei
- cpe:2.3:h:huawei:p30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:p30_pro_firmware:*:*:*:*:*:*:*:* Versions before vogue-al00a_9.1.0.193\(c00e190r1p12\) Vulnerable ·Huawei
- cpe:2.3:h:huawei:p30_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:honor_v20_firmware:*:*:*:*:*:*:*:* Versions before princeton-al10b_9.1.0.233\(c00e233r4p3\) Vulnerable ·Huawei
- cpe:2.3:h:huawei:honor_v20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-5228
- 2026-10-03 Alias added: GHSA-46rj-wmc7-5p68
- 2026-10-19 EPSS moved to the 50th–90th percentile
References
More Huawei Honor V20 Firmware vulnerabilities
- TI-2020-07385 HUAWEI Mate 20 versions Versions earlier than 10.1.0.160(C00E160R3P8);HUAWEI Mate 20 Pro… CVSS 3.1MEDIUM 6.8
- TI-2020-01741 Improper authentication in Huawei Honor V20 CVSS 3.1MEDIUM 5.3
- TI-2019-03732 Improper input validation in Huawei ALP-AL00B CVSS 3.1MEDIUM 5.3
- TI-2019-03731 Improper input validation in Huawei Sydney-L21 CVSS 3.1MEDIUM 5.3
- TI-2019-03730 Huawei smart phones Honor V20 with the versions before 9.0.1.161(C00E161R2P2) have an… CVSS 3.0LOW 3.3
Sources
- CVE-2019-5228 · CVE Program
- CVE-2019-5228 · NVD
- FIRST EPSS
- GHSA-46rj-wmc7-5p68 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences