Read the docs
TI-2019-03679 Aliases CVE-2019-5246GHSA-fqf6-vc5w-q8r5

Insufficient verification of data authenticity in ELLE-AL00B

Priority LOW 27CWE-345Published · Updated

Key facts

Attack vector
Physical
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-345.

Summary

Smartphones with software of ELLE-AL00B 9.1.0.109(C00E106R1P21), 9.1.0.113(C00E110R1P21), 9.1.0.125(C00E120R1P21), 9.1.0.135(C00E130R1P21), 9.1.0.153(C00E150R1P21), 9.1.0.155(C00E150R1P21), 9.1.0.162(C00E160R2P1) have an insufficient verification vulnerability. The system does not verify certain parameters sufficiently, an attacker should connect to the phone and gain high privilege to launch the attack. Successful exploit could cause DOS or malicious code execution.

Why it matters now

EPSS 0.00171 6th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—ELLE-AL00B9.1.0.109(C00E106R1P21), 9.1.0.113(C00E110R1P21), 9.1.0.125(C00E120R1P21), 9.1.0.135(C00E130R1P21), 9.1.0.153(C00E150R1P21), 9.1.0.155(C00E150R1P21), 9.1.0.162(C00E160R2P1)—No fix listedCNA
  • ELLE-AL00B Vendor— Affected 9.1.0.109(C00E106R1P21), 9.1.0.113(C00E110R1P21), 9.1.0.125(C00E120R1P21), 9.1.0.135(C00E130R1P21), 9.1.0.153(C00E150R1P21), 9.1.0.155(C00E150R1P21), 9.1.0.162(C00E160R2P1) Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:o:huawei:elle-al00b_firmware:9.1.0.109\(c00e106r1p21\):*:*:*:*:*:*:*9.1.0.109(c00e106r1p21)VulnerableHuawei
cpe:2.3:o:huawei:elle-al00b_firmware:9.1.0.113\(c00e110r1p21\):*:*:*:*:*:*:*9.1.0.113(c00e110r1p21)VulnerableHuawei
cpe:2.3:o:huawei:elle-al00b_firmware:9.1.0.125\(c00e120r1p21\):*:*:*:*:*:*:*9.1.0.125(c00e120r1p21)VulnerableHuawei
cpe:2.3:o:huawei:elle-al00b_firmware:9.1.0.135\(c00e130r1p21\):*:*:*:*:*:*:*9.1.0.135(c00e130r1p21)VulnerableHuawei
cpe:2.3:o:huawei:elle-al00b_firmware:9.1.0.153\(c00e150r1p21\):*:*:*:*:*:*:*9.1.0.153(c00e150r1p21)VulnerableHuawei
cpe:2.3:o:huawei:elle-al00b_firmware:9.1.0.155\(c00e150r1p21\):*:*:*:*:*:*:*9.1.0.155(c00e150r1p21)VulnerableHuawei
cpe:2.3:o:huawei:elle-al00b_firmware:9.1.0.162\(c00e160r2p1\):*:*:*:*:*:*:*9.1.0.162(c00e160r2p1)VulnerableHuawei
cpe:2.3:h:huawei:elle-al00b:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
  • cpe:2.3:o:huawei:elle-al00b_firmware:9.1.0.109\(c00e106r1p21\):*:*:*:*:*:*:* Versions 9.1.0.109(c00e106r1p21) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:elle-al00b_firmware:9.1.0.113\(c00e110r1p21\):*:*:*:*:*:*:* Versions 9.1.0.113(c00e110r1p21) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:elle-al00b_firmware:9.1.0.125\(c00e120r1p21\):*:*:*:*:*:*:* Versions 9.1.0.125(c00e120r1p21) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:elle-al00b_firmware:9.1.0.135\(c00e130r1p21\):*:*:*:*:*:*:* Versions 9.1.0.135(c00e130r1p21) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:elle-al00b_firmware:9.1.0.153\(c00e150r1p21\):*:*:*:*:*:*:* Versions 9.1.0.153(c00e150r1p21) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:elle-al00b_firmware:9.1.0.155\(c00e150r1p21\):*:*:*:*:*:*:* Versions 9.1.0.155(c00e150r1p21) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:elle-al00b_firmware:9.1.0.162\(c00e160r2p1\):*:*:*:*:*:*:* Versions 9.1.0.162(c00e160r2p1) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:elle-al00b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-5246
  2. 2026-10-03 Alias added: GHSA-fqf6-vc5w-q8r5

References

Advisory 1

  • TI-2019-03705 Buffer overflow in Huawei ELLE-AL00B CVSS 3.1HIGH 8.8
  • TI-2019-03669 NULL pointer dereference in Harry-AL00C, Harry-AL00C-PRELOAD, Harry-AL10B… CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences