Medium severity · published Mar 20, 2020
CVE-2020-1878
Huawei smartphone OxfordS-AN00A with versions earlier than 10.0.1.152D(C735E152R3P3),versions earlier than 10.0.1.160(C00E160R4P1) have an improper authentication vulnerability
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
Huawei smartphone OxfordS-AN00A with versions earlier than 10.0.1.152D(C735E152R3P3),versions earlier than 10.0.1.160(C00E160R4P1) have an improper authentication vulnerability. Authentication to target component is improper when device performs an operation. Attackers exploit this vulnerability to obtain some information by loading malicious application, leading to information leak.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
Oxfords-an00a Firmware · Huawei
after 10.0.1.152d\(c735e152r3p3\) before 10.0.1.160\(c00e160r4p1\); before 10.0.1.152d\(c735e152r3p3\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-1878
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-1878
Not Applicable
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200415-02-dos-en
Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200311-01-informationleak-en
More from Oxfords-an00a Firmware
5.5
CVE-2021-22400
Some Huawei Smartphones has an insufficient input validation vulnerability due to the lack of parameter validation
5.5
CVE-2020-9235
Huawei smartphones HONOR 20 PRO Versions earlier than 10.1.0.230(C432E9R5P1),Versions earlier than 10.1.0.231(C10E3R3P2),Versions earlier than 10.1.0.231(C185E3R5P1),Versions…
4.6
CVE-2021-22440
There is a path traversal vulnerability in some Huawei products