CVE-2019-5284

Vulnerability

The Real-Time Streaming Protocol (RTSP) module in Huawei Leland-AL00A smartphones running versions earlier than Leland-AL00A 9.1.0.111(C00E111R2P10T8) contains a denial-of-service (DoS) vulnerability [1][2]. When the phone processes a specially crafted RTSP media stream, the bug can be triggered without requiring any special configuration beyond user interaction to open the stream.

Exploitation

A remote attacker must first trick the user into opening a malformed RTSP media stream, for example by luring the user to a malicious link or sending a crafted stream URL [1][2]. No further authentication or network privileges are described beyond the ability to deliver the stream to the device.

Impact

Successful exploitation of the vulnerability causes the affected phone to become abnormal, leading to a denial-of-service (DoS) condition [1][2]. The device may become unresponsive or crash, disrupting normal operation. The advisory does not indicate any information disclosure or privilege escalation.

Mitigation

Huawei has released a software update to fix this vulnerability [1][2]. The resolved version is Leland-AL00A 9.1.0.111(C00E111R2P10T8). Users should update their devices to this version or later. No workaround is mentioned in the available references. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of this writing.