CVE-2019-5215

Vulnerability

A man-in-the-middle (MITM) vulnerability exists in the Huawei Share feature on Huawei P30 smartphones (models ELE-AL00) and P30 Pro smartphones (models VOG-AL00). It affects versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) and VOG-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) [1]. The flaw occurs when users establish a connection and transfer data through Huawei Share, as the communication channel is not sufficiently protected against interception.

Exploitation

An attacker in a position to perform network sniffing and spoofing can intrude upon the Huawei Share connection while users are transferring data. This requires the attacker to be within wireless range of the target device's Huawei Share session [1]. No user interaction beyond normal data transfer is needed for the attack to take place.

Impact

Successful exploitation allows the attacker to perform a man-in-the-middle attack, obtaining and tampering with the data being transferred between the devices [1]. This compromises confidentiality and integrity of the exchanged information; the attacker may read, modify, or inject data without the users' knowledge.

Mitigation

Huawei has released software updates to fix this vulnerability. The resolved versions are ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) and VOG-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) [1]. Users should update their devices to these or later versions.