Skip to content
Fencer Vulns
medium 4.6

CVE-2019-19412 json

Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability.

published 2020-06-08 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-9033

cvss
4.6
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits
0
none known

Summary

Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker login the Talkback mode and can perform some operations to install a third-Party application. Affected products can be found in https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-frp-en.

Patch / fix

  • huawei alp-al00b_firmware 9.0.0.181\(c00e87r2p20t8\)
  • huawei alp-l09_firmware 9.0.0.201\(c432e4r1p9\)
  • huawei alp-l29_firmware 9.0.0.177\(c185e2r1p12t8\), 9.0.0.195\(c636e2r1p12\)
  • huawei anne-al00_firmware 8.0.0.168\(c00\)
  • huawei bla-al00b_firmware 9.0.0.181\(c00e88r2p15t8\)
  • huawei bla-l09c_firmware 9.0.0.177\(c185e2r1p13t8\), 9.0.0.206\(c432e4r1p11\)
  • huawei bla-l29c_firmware 9.0.0.179\(c576e2r1p7t8\), 9.0.0.194\(c185e2r1p13\), 9.0.0.206\(c432e4r1p11\), 9.0.0.210\(c635e4r1p13\)
  • huawei berkeley-al20_firmware 9.0.0.156\(c00e156r2p14t8\)
  • huawei berkeley-l09_firmware 8.0.0.172\(c432\), 8.0.0.173\(c636\)
  • huawei emily-l29c_firmware 9.0.0.159\(c185e2r1p12t8\), 9.0.0.159\(c461e2r1p11t8\), 9.0.0.160\(c432e7r1p11t8\), 9.0.0.165\(c605e2r1p12\), 9.0.0.168\(c636e7r1p13t8\), 9.0.0.168\(c782e3r1p11t8\), 9.0.0.196\(c635e2r1p11t8\)
  • huawei figo-l03_firmware 9.1.0.130\(c605e6r1p5t8\)
  • huawei figo-l21_firmware 9.1.0.130\(c185e6r1p5t8\), 9.1.0.130\(c635e6r1p5t8\)
  • huawei figo-l23_firmware 9.1.0.130\(c605e6r1p5t8\)
  • huawei figo-l31_firmware 9.1.0.130\(c432e8r1p5t8\)
  • huawei florida-l03_firmware 9.1.0.121\(c605e5r1p1t8\)
  • huawei florida-l21_firmware 8.0.0.129\(c605\), 8.0.0.131\(c432\), 8.0.0.132\(c185\)
  • huawei florida-l22_firmware 8.0.0.132\(c636\)
  • huawei florida-l23_firmware 8.0.0.144\(c605\)
  • huawei p_smart_firmware 9.1.0.124\(c636e6r1p5t8\), 9.1.0.130\(c185e6r1p5t8\), 9.1.0.130\(c605e6r1p5t8\)
  • huawei y7s_firmware 9.1.0.124\(c636e6r1p5t8\)

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:N/I:P/A:N

Affected products

  • Huawei ALP-AL00B
  • Huawei ALP-L09
  • Huawei ALP-L29
  • Huawei Anne-AL00
  • Huawei BLA-AL00B
  • Huawei BLA-L09C
  • Huawei BLA-L29C
  • Huawei Berkeley-AL20
  • Huawei Berkeley-L09
  • Huawei Emily-L29C
  • Huawei Figo-L03
  • Huawei Figo-L21
  • Huawei Figo-L23
  • Huawei Figo-L31
  • Huawei Florida-L03
  • Huawei Florida-L21
  • Huawei Florida-L22
  • Huawei Florida-L23
  • Huawei HUAWEI P smart
  • Huawei HUAWEI P smart,HUAWEI Y7s
  • Huawei HUAWEI P20 lite
  • Huawei HUAWEI nova 3e,HUAWEI P20 lite
  • Huawei Honor View 10
  • Huawei Leland-AL00A
  • Huawei Leland-L21A
  • Huawei Leland-L22A
  • Huawei Leland-L22C
  • Huawei Leland-L31A

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.