CVE-2019-5308

Vulnerability

An improper authorization vulnerability exists in Huawei Mate 20 RS smartphones running versions earlier than 9.1.0.135(C786E133R3P1) [1]. The software fails to properly restrict certain operations when the device is in Android Debug Bridge (ADB) mode. This allows an attacker to perform actions that should be unauthorized, specifically the ability to switch to a third desktop environment.

Exploitation

To exploit this vulnerability, an attacker must have access to the device while it is in ADB mode, typically requiring a USB connection and ADB debugging enabled. The attacker then executes a series of operations (likely ADB commands) to trigger the unauthorized switch to a third desktop [1]. No authentication is needed beyond the ADB connection, but physical or USB access to the device is required.

Impact

Successful exploitation allows the attacker to switch the device's desktop environment to a third-party launcher or desktop. This could bypass security controls enforced by the default desktop, potentially enabling further unauthorized actions or access to sensitive data. The impact is limited to changing the desktop, but it may serve as a stepping stone for more severe attacks.

Mitigation

Huawei has released a software update to fix this vulnerability. Users should upgrade their Mate 20 RS to version 9.1.0.135(C786E133R3P1) or later [1]. No workarounds are provided in the advisory. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.