CVE-2019-5220

Vulnerability

A Factory Reset Protection (FRP) bypass vulnerability exists in the setup wizard of several Huawei and Honor smartphones. The system does not sufficiently verify the permission during certain operations in the setup wizard, allowing an attacker to bypass FRP. Affected products and versions: Mate 20 X (versions earlier than Ever-AL00B 9.0.0.200(C00E200R2P1)), Mate 20 (versions earlier than Hima-AL00B/Hima-TL00B 9.0.0.200(C00E200R2P1)), and Honor Magic 2 (versions earlier than Tony-AL00B/Tony-TL00B 9.0.0.182(C00E180R2P2)). [1]

Exploitation

An attacker requires physical access to the device and must be able to interact with the setup wizard. By performing a certain operation on a certain step of the setup wizard, the attacker can exploit the insufficient permission verification to bypass the FRP protection. The exact operation and step are not disclosed in the available references. [1]

Impact

A successful exploit allows the attacker to bypass the Factory Reset Protection (FRP) on the device. This enables unauthorized access to the device, potentially compromising confidentiality and integrity of user data stored on the phone. [1]

Mitigation

Huawei has released software updates to fix this vulnerability. The resolved versions are: Mate 20 X (Ever-AL00B 9.0.0.200(C00E200R2P1)), Mate 20 (Hima-AL00B/Hima-TL00B 9.0.0.200(C00E200R2P1)), and Honor Magic 2 (Tony-AL00B/Tony-TL00B 9.0.0.182(C00E180R2P2)). Users should update to these or later versions to mitigate the issue. No workaround is mentioned in the advisory. [1]