CVE-2019-5226

Vulnerability

A version downgrade vulnerability exists in Huawei P30 (versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1)), P30 Pro (versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R2P1)), Mate 20 (versions earlier than Hima-AL00B 9.1.0.135(C00E133R2P1)), and HiSuite (versions earlier than 9.1.0.305). The device and HiSuite software do not validate the upgrade package sufficiently, allowing the smartphone system to be downgraded to an older version [1].

Exploitation

An attacker with network access or physical access can provide a malicious downgrade package that the software accepts without proper validation. No authentication is explicitly mentioned, but the attack likely requires the attacker to control the upgrade source or be in a position to perform a man-in-the-middle attack during an update session [1].

Impact

Successful exploitation allows an attacker to downgrade the smartphone system to an older, less secure version. This could enable the exploitation of previously patched vulnerabilities, leading to potential information disclosure, privilege escalation, or other security compromises depending on the vulnerabilities present in the older firmware [1].

Mitigation

Huawei has released software updates to fix these vulnerabilities: ELLE-AL00B 9.1.0.193(C00E190R2P1) for P30, VOGUE-AL00A 9.1.0.193(C00E190R2P1) for P30 Pro, Hima-AL00B 9.1.0.135(C00E133R2P1) for Mate 20, and HiSuite 9.1.0.305 for HiSuite [1]. Users should update their software to these versions or later.