What is CVE-2019-5288?

CVE-2019-5288 is a high-severity vulnerability in Huawei P30, classified under Integer Overflow or Wraparound. CVSS score: 7.8/10. Published 2019-11-13.

How severe is CVE-2019-5288?

High severity. CVSS v3 base score is 7.8 out of 10.

Integer overflow in Huawei P30

CVE-2019-5288

P30 smart phones with versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1) have an integer overflow vulnerability due to insufficient check on specific parameters. An attacker tricks the user into installing a malicious application, obtains the root permission and constructs specific parameters to the camera program to exploit this vulnerability. Successful exploit could cause the program to break down or allow for arbitrary code execution.

Vulnerability class: Integer Overflow

EPSS: 0.009 (57.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Huawei P30
Huawei P30_firmware
N/a P30 — versions Versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1)

Weakness classification (CWE)

CWE-190 — Integer Overflow or Wraparound

References

psirt@huawei.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2019-5288?: CVE-2019-5288 is a high-severity vulnerability in Huawei P30, classified under Integer Overflow or Wraparound. CVSS score: 7.8/10. Published 2019-11-13.
How severe is CVE-2019-5288?: High severity. CVSS v3 base score is 7.8 out of 10.