CVE-2019-5251

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-12-13 · updated 2026-06-17
Weakness: CWE-22

Description

There is a path traversal vulnerability in several Huawei smartphones. The system does not sufficiently validate certain pathnames from the application. An attacker could trick the user into installing, backing up and restoring a malicious application. Successful exploit could cause information disclosure.

Affected products

Huawei Enjoy 7S Firmware: before 9.1.0.130\(c00e115r2p8t8\) — fixed in 9.1.0.130\(c00e115r2p8t8\)
Huawei Honor 20S Firmware: before 9.1.1.132\(c00e131r6p1\) — fixed in 9.1.1.132\(c00e131r6p1\)
Huawei Honor 9 Lite Firmware: before 9.1.0.143\(c636e5r1p5t8\); before 9.1.0.130\(c00e112r2p10t8\) — fixed in 9.1.0.130\(c00e112r2p10t8\), 9.1.0.143\(c636e5r1p5t8\)
Huawei Honor 9I Firmware: before 9.1.0.120\(c00e113r1p6t8\) — fixed in 9.1.0.120\(c00e113r1p6t8\)
Huawei Honor V10: before 9.1.0.333\(c00e333r2p1t8\) — fixed in 9.1.0.333\(c00e333r2p1t8\)
Huawei M6 Firmware: before 9.1.1.150\(c00e150r1p150\) — fixed in 9.1.1.150\(c00e150r1p150\)
HUAWEI Mate 20: before 9.1.0.139\(c00e133r3p1\) — fixed in 9.1.0.139\(c00e133r3p1\)
HUAWEI P30: before 9.1.0.226\(c00e220r2p1\) — fixed in 9.1.0.226\(c00e220r2p1\)
HUAWEI P30 Pro: before 9.1.0.226\(c00e210r2p1\) — fixed in 9.1.0.226\(c00e210r2p1\)

How to fix

Upgrade to a fixed version: Huawei Enjoy 7S Firmware 9.1.0.130\(c00e115r2p8t8\); Huawei Honor 20S Firmware 9.1.1.132\(c00e131r6p1\); Huawei Honor 9 Lite Firmware 9.1.0.130\(c00e112r2p10t8\), 9.1.0.143\(c636e5r1p5t8\); Huawei Honor 9I Firmware 9.1.0.120\(c00e113r1p6t8\); Huawei Honor V10 9.1.0.333\(c00e333r2p1t8\); Huawei M6 Firmware 9.1.1.150\(c00e150r1p150\); HUAWEI Mate 20 9.1.0.139\(c00e133r3p1\); HUAWEI P30 9.1.0.226\(c00e220r2p1\); HUAWEI P30 Pro 9.1.0.226\(c00e210r2p1\). Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-5251 or the next vulnerability affects your stack