What is CVE-2019-5218?

CVE-2019-5218 is a high-severity vulnerability in Huawei Band 2, classified under Improper Authentication. CVSS score: 8.8/10. Published 2019-11-29.

How severe is CVE-2019-5218?

High severity. CVSS v3 base score is 8.8 out of 10.

Auth bypass in Huawei Band 2

CVE-2019-5218

There is an insufficient authentication vulnerability in Huawei Band 2 and Honor Band 3. The band does not sufficiently authenticate the device try to connect to it in certain scenario. Successful exploit could allow the attacker to spoof then connect to the band.

Vulnerability class: Broken Authentication

EPSS: 0.004 (31.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Huawei Band_2
Huawei Band_2_firmware
Huawei Band_3
Huawei Band_3_firmware
N/a Huawei Band 2, Honor 3 — versions Versions earlier than Eris-B19/Eris-B29 1.2.53, Versions earlier than NYX-B10HN 1.5.53

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

psirt@huawei.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2019-5218?: CVE-2019-5218 is a high-severity vulnerability in Huawei Band 2, classified under Improper Authentication. CVSS score: 8.8/10. Published 2019-11-29.
How severe is CVE-2019-5218?: High severity. CVSS v3 base score is 8.8 out of 10.