TI-2019-03664 Aliases CVE-2019-5229 GHSA-7332-327w-xhcp

Insufficient verification of data authenticity in P30

LOW 27CWE-345Published 2019-11-12 · Updated 2024-08-04

Key facts

Attack vector: Physical
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-345.

Summary

P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1) have an insufficient verification vulnerability. The system does not verify certain parameters sufficiently, an attacker should connect to the phone and gain high privilege to launch the attack, successful exploit could cause malicious code execution.

Why it matters now

EPSS 0.00171 6th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	P30	Versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1)	—	No fix listed	CNA

P30 Vendor— Affected Versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1) Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:huawei:p30_firmware::::::::	before elle-al00b_9.1.0.193\(c00e190r2p1\)	Vulnerable	Huawei
cpe:2.3:h:huawei:p30:-:::::::*	not specified by NVD	Running on	Huawei

cpe:2.3:o:huawei:p30_firmware:*:*:*:*:*:*:*:* Versions before elle-al00b_9.1.0.193\(c00e190r2p1\) Vulnerable ·Huawei
cpe:2.3:h:huawei:p30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2019-5229
2026-10-03 Alias added: GHSA-7332-327w-xhcp

References

Advisory 1

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190925-02-smartphone-en

TI-2020-00021 In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write… CVSS 3.1HIGH 8.8
TI-2019-06941 Cryptographic flaw in Bluetooth BR/EDR CVSS 3.1HIGH 8.1
TI-2020-07404 Use after free in HUAWEI Mate 30;HUAWEI P30 CVSS 3.1HIGH 7.8
TI-2020-07388 Buffer overflow in Huawei HONOR 20 PRO CVSS 3.1HIGH 7.8
TI-2019-03717 Integer overflow in P30 CVSS 3.1HIGH 7.8
TI-2019-03716 Integer overflow in P30 CVSS 3.1HIGH 7.8

See all 42 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences