Medium severity · published Jan 9, 2020
CVE-2020-1787
HUAWEI Mate 20 smartphones versions earlier than 9.1.0.139(C00E133R3P1) have an improper authentication vulnerability
6.6
CVSS
0.3%
EPSS
No
On KEV
Description
HUAWEI Mate 20 smartphones versions earlier than 9.1.0.139(C00E133R3P1) have an improper authentication vulnerability. The system has a logic error under certain scenario, successful exploit could allow the attacker who gains the privilege of guest user to access to the host user's desktop in an instant, without unlocking the screen lock of the host user.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
M2
Mate 20 Firmware · Huawei
before 9.1.0.139\(c00e133r3p1\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-1787
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-1787
Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200108-02-smartphone-en
More from Mate 20 Firmware
8.8
CVE-2020-0022
In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation
8.0
CVE-2020-9113
HUAWEI Mate 20 versions earlier than 10.0.0.188(C00E74R3P8) have a buffer overflow vulnerability in the Bluetooth module
7.8
CVE-2020-9247
There is a buffer overflow vulnerability in several Huawei products
7.8
CVE-2019-5225
P30, Mate 20, P30 Pro smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), versions earlier than Hima-AL00B 9.1.0.135(C00E200R2P1), versions…
6.8
CVE-2020-9081
There is an improper authorization vulnerability in some Huawei smartphones