CVE-2019-5227

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-11-29 · updated 2026-06-17
Weakness: CWE-346

Description

P30, P30 Pro, Mate 20 smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1), versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R2P1), versions earlier than Hima-AL00B 9.1.0.135(C00E133R2P1) and HiSuite with versions earlier than HiSuite 9.1.0.305 have a version downgrade vulnerability. The device and HiSuite software do not validate the upgrade package sufficiently, so that the system of smartphone can be downgraded to an older version.

Affected products

Huawei Hisuite Firmware: before 9.1.0.305 — fixed in 9.1.0.305
HUAWEI Mate 20: before hima-al00b_9.1.0.135\(c00e133r2p1\) — fixed in hima-al00b_9.1.0.135\(c00e133r2p1\)
HUAWEI P30: before elle-al00b_9.1.0.193\(c00e190r2p1\) — fixed in elle-al00b_9.1.0.193\(c00e190r2p1\)
HUAWEI P30 Pro: before vogue-al00a_9.1.0.193\(c00e190r2p1\) — fixed in vogue-al00a_9.1.0.193\(c00e190r2p1\)

How to fix

Upgrade to a fixed version: Huawei Hisuite Firmware 9.1.0.305; HUAWEI Mate 20 hima-al00b_9.1.0.135\(c00e133r2p1\); HUAWEI P30 elle-al00b_9.1.0.193\(c00e190r2p1\); HUAWEI P30 Pro vogue-al00a_9.1.0.193\(c00e190r2p1\). Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-5227 or the next vulnerability affects your stack