There is a path traversal vulnerability in several Huawei smartphones. The system does not sufficiently validate certain pathnames from…

Description

There is a path traversal vulnerability in several Huawei smartphones. The system does not sufficiently validate certain pathnames from the application. An attacker could trick the user into installing, backing up and restoring a malicious application. Successful exploit could cause information disclosure.

Scores

EPSS (exploitation in 30 days)

0.84% · top 42% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.

Weakness

• Path Traversal
• CWE-22 (opens in a new tab)All about CWE-22 and its CVEs

Affected products

• Honor V10;P30;Mate 20;Honor 9 Lite;Honor 9i;M6;P30 Pro;Honor 20s

  • affected Versions earlier than 9.1.0.333(C00E333R2P1T8)
  • affected Versions earlier than 9.1.0.226(C00E220R2P1)
  • affected Versions earlier than 9.1.0.130(C00E115R2P8T8)
  • affected Versions earlier than 9.1.0.139(C00E133R3P1)
  • affected Versions earlier than 9.1.0.130(C00E112R2P10T8)
  • affected Versions earlier than 9.1.0.143(C636E5R1P5T8)
  • affected Versions earlier than 9.1.0.120(C00E113R1P6T8)
  • affected Versions earlier than 9.1.1.150(C00E150R1P150)
  • affected Versions earlier than 9.1.0.226(C00E210R2P1)
  • affected Versions earlier than 9.1.1.132(C00E131R6P1)

References (1)

• https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-03-smartphone-en (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-5251](https://trackcve.app/badge/CVE-2019-5251.svg)](https://trackcve.app/cve/CVE-2019-5251)

Record last updated 4 Aug 2024, 19:47 UTC.