Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker login the Talkback mode and can perform some operations to install a third-Party applicatio
Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker login the Talkback mode and can perform some operations to install a third-Party application. Affected products can be found in https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-frp-en.
| Vendor | Product | Versions |
|---|---|---|
| Huawei | ALP | AL00B — earlier than 9.0.0.181(C00E87R2P20T8) |
| Huawei | ALP | L09 — earlier than 9.0.0.201(C432E4R1P9) |
| Huawei | ALP | L29 — earlier than 9.0.0.177(C185E2R1P12T8), earlier than 9.0.0.195(C636E2R1P12) |
| Huawei | Anne | AL00 — earlier than 8.0.0.168(C00) |
| Huawei | BLA | AL00B — earlier than 9.0.0.181(C00E88R2P15T8) |
| Huawei | BLA | L09C — earlier than 9.0.0.177(C185E2R1P13T8), earlier than 9.0.0.206(C432E4R1P11) |
| Huawei | BLA | L29C — earlier than 9.0.0.179(C576E2R1P7T8), earlier than 9.0.0.194(C185E2R1P13), earlier than 9.0.0.206(C432E4R1P11), earlier than 9.0.0.210(C635E4R1P13) |
| Huawei | Berkeley | AL20 — earlier than 9.0.0.156(C00E156R2P14T8) |
| Huawei | Berkeley | L09 — earlier than 8.0.0.172(C432), earlier than 8.0.0.173(C636) |
| Huawei | Emily | L29C — earlier than 9.0.0.159(C185E2R1P12T8), earlier than 9.0.0.159(C461E2R1P11T8), earlier than 9.0.0.160(C432E7R1P11T8), earlier than 9.0.0.165(C605E2R1P12), earlier than 9.0.0.168(C636E7R1P13T8), earlier than 9.0.0.168(C782E3R1P11T8), earlier than 9.0.0.196(C635E2R1P11T8) |
| Huawei | Figo | L03 — earlier than 9.1.0.130(C605E6R1P5T8) |
| Huawei | Figo | L21 — earlier than 9.1.0.130(C185E6R1P5T8), earlier than 9.1.0.130(C635E6R1P5T8) |
| Huawei | Figo | L23 — earlier than 9.1.0.130(C605E6R1P5T8) |
| Huawei | Figo | L31 — earlier than 9.1.0.130(C432E8R1P5T8) |
| Huawei | Florida | L03 — earlier than 9.1.0.121(C605E5R1P1T8) |
| Huawei | Florida | L21 — earlier than 8.0.0.129(C605), earlier than 8.0.0.131(C432), earlier than 8.0.0.132(C185) |
| Huawei | Florida | L22 — earlier than 8.0.0.132(C636) |
| Huawei | Florida | L23 — earlier than 8.0.0.144(C605) |
| Huawei | HUAWEI P smart | earlier than 9.1.0.130(C185E6R1P5T8), earlier than 9.1.0.130(C605E6R1P5T8) |
| Huawei | HUAWEI P smart,HUAWEI Y7s | earlier than 9.1.0.124(C636E6R1P5T8) |
| Huawei | HUAWEI P20 lite | earlier than 8.0.0.148(C635), earlier than 8.0.0.155(C185), earlier than 8.0.0.155(C605), earlier than 8.0.0.156(C605), earlier than 8.0.0.157(C432) |
| Huawei | HUAWEI nova 3e,HUAWEI P20 lite | earlier than 8.0.0.147(C461), earlier than 8.0.0.148(ZAFC185), earlier than 8.0.0.160(C185), earlier than 8.0.0.160(C605), earlier than 8.0.0.168(C432), earlier than 8.0.0.172(C636) |
| Huawei | Honor View 10 | earlier than 9.0.0.202(C567E6R1P12T8) |
| Huawei | Leland | AL00A — earlier than 8.0.0.182(C00) |
| Huawei | Leland | L21A — earlier than 8.0.0.135(C185), earlier than 9.1.0.118(C636E4R1P1T8) |
| Huawei | Leland | L22A — earlier than 9.1.0.118(C636E4R1P1T8) |
| Huawei | Leland | L22C — earlier than 9.1.0.118(C636E4R1P1T8) |
| Huawei | Leland | L31A — earlier than 8.0.0.139(C432) |
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.