Lucene search

HuaweiCVE-2019-5218

HistoryNov 29, 2019 - 8:15 p.m.

CVE-2019-5218

2019-11-2920:15:11

CWE-287

huawei

web.nvd.nist.gov

cve-2019-5218

insufficient authentication

huawei band 2

honor band 3

nvd

CVSS2

5.8

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

30.2%

JSON

There is an insufficient authentication vulnerability in Huawei Band 2 and Honor Band 3. The band does not sufficiently authenticate the device try to connect to it in certain scenario. Successful exploit could allow the attacker to spoof then connect to the band.

Affected configurations

Nvd

Vulners

Node

huaweiband_2_firmwareRange<eris-b19\/eris-b29_1.2.53

AND

huaweiband_2Match-

Node

huaweiband_3_firmwareRange<nyx-b10hn_1.5.53

AND

huaweiband_3Match-

VendorProductVersionCPE
huaweiband_2_firmware*cpe:2.3:o:huawei:band_2_firmware:*:*:*:*:*:*:*:*
huaweiband_2-cpe:2.3:h:huawei:band_2:-:*:*:*:*:*:*:*
huaweiband_3_firmware*cpe:2.3:o:huawei:band_3_firmware:*:*:*:*:*:*:*:*
huaweiband_3-cpe:2.3:h:huawei:band_3:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	band_2_firmware	*	cpe:2.3:o:huawei:band_2_firmware::::::::
huawei	band_2	-	cpe:2.3:h:huawei:band_2:-:::::::*
huawei	band_3_firmware	*	cpe:2.3:o:huawei:band_3_firmware::::::::
huawei	band_3	-	cpe:2.3:h:huawei:band_3:-:::::::*

CNA Affected

[
  {
    "product": "Huawei Band 2, Honor Band 3",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Versions earlier than Eris-B19/Eris-B29 1.2.53, Versions earlier than NYX-B10HN 1.5.53"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20191106-01-band-en

CVSS2

5.8

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

30.2%

JSON

Related for CVE-2019-5218