CVE-2019-5220: There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones. The system does not sufficiently verify the permission, an attacker…

PriorityP420medium4.6CVSS 3.0

AVPACLPRNUINSUCNIHAN

EPSS

0.22%

12.9th percentile

There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones. The system does not sufficiently verify the permission, an attacker could do a certain operation on certain step of setup wizard. Successful exploit could allow the attacker bypass the FRP protection. Affected products: Mate 20 X, versions earlier than Ever-AL00B 9.0.0.200(C00E200R2P1); Mate 20, versions earlier than Hima-AL00B/Hima-TL00B 9.0.0.200(C00E200R2P1); Honor Magic 2, versions earlier than Tony-AL00B/Tony-TL00B 9.0.0.182(C00E180R2P2).

Affected

6 ranges

Vendor	Product	Version range	Fixed in
huawei	honor_magic_2	—	—
huawei	honor_magic_2_firmware	< tony-al00b\/tony-tl00b_9.0.0.182\(c00e180r2p2\)	tony-al00b\/tony-tl00b_9.0.0.182\(c00e180r2p2\)
huawei	mate_20	—	—
huawei	mate_20_firmware	< hima-al00b\/hima-tl00b_9.0.0.200\(c00e200r2p1\)	hima-al00b\/hima-tl00b_9.0.0.200\(c00e200r2p1\)
huawei	mate_20_x	—	—
huawei	mate_20_x_firmware	< ever-al00b_9.0.0.200\(c00e200r2p1\)	ever-al00b_9.0.0.200\(c00e200r2p1\)

CVSS provenance

nvdv3.04.6MEDIUMCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.