Medium severity · published May 21, 2020
CVE-2020-9069
There is an information leakage vulnerability in some Huawei products
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
There is an information leakage vulnerability in some Huawei products. An unauthenticated, adjacent attacker could exploit this vulnerability to decrypt data. Successful exploitation may leak information randomly. Affected product versions include: Anne-AL00 Versions earlier than 9.1.0.331(C675E9R1P3T8); Berkeley-L09 Versions earlier than 10.0.1.1(C675R1); CD16-10 Versions earlier than 10.0.2.8; CD17-10 Versions earlier than 10.0.2.8; CD17-16 Versions earlier than 10.0.2.8; CD18-10 Versions earlier than 10.0.2.8; CD18-16 Versions earlier than 10.0.2.8; Columbia-TL00B Versions earlier than 9.0.0.187(C01E181R1P20T8); E6878-370 Versions earlier than 10.0.5.1(H610SP10C00); HUAWEI P30 lite Versions earlier than 10.0.0.185(C605E3R1P3), Versions earlier than 10.0.0.197(C432E8R2P7); HUAWEI nova 4e Versions earlier than 10.0.0.158(C00E64R1P9); Honor 10 Lite 9.0.1.113(C675E11R1P12); LelandP-L22A Versions earlier than 9.1.0.166(C675E5R1P4T8); Marie-AL00AX Versions earlier than 10.0.0.158(C00E64R1P9); Marie-AL00AY Versions earlier than 10.0.0.158(C00E64R1P9); Marie-AL00BX Versions earlier than 10.0.0.158(C00E64R1P9); Marie-L03BX Versions earlier than 10.0.0.188(C605E5R1P1); Marie-L21BX Versions earlier than 10.0.0.188(C432E4R4P1), Versions earlier than 10.0.0.188(C461E5R3P1); Marie-L22BX Versions earlier than 10.0.0.188(C636E3R3P1); Marie-L23BX Versions earlier than 10.0.0.188(C605E5R1P1); TC5200-16 Versions earlier than 10.0.2.8; WS5200-11 Versions earlier than 10.0.2.8; WS5200-12 Versions earlier than 10.0.2.23; WS5200-16 Versions earlier than 10.0.2.8; WS5200-17 Versions earlier than 10.0.2.23; WS5800-10 Versions earlier than 10.0.3.27; WS6500-10 Versions earlier than 10.0.2.8; WS6500-16 Versions earlier than 10.0.2.8
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Anne-al00 Firmware · Huawei
before 9.1.0.331\(c675e9r1p3t8\) · source: NVD
BF
Berkeley-l09 Firmware · Huawei
before 10.0.1.1\(c675r1\) · source: NVD
CF
Cd16-10 Firmware · Huawei
before 10.0.2.8 · source: NVD
CF
Cd17-10 Firmware · Huawei
before 10.0.2.8 · source: NVD
CF
Cd17-16 Firmware · Huawei
before 10.0.2.8 · source: NVD
CF
Cd18-10 Firmware · Huawei
before 10.0.2.8 · source: NVD
CF
Cd18-16 Firmware · Huawei
before 10.0.2.8 · source: NVD
CF
Columbia-tl00b Firmware · Huawei
before 9.0.0.187\(c01e181r1p20t8\) · source: NVD
EF
E6878-370 Firmware · Huawei
before 10.0.5.1\(h610sp10c00\) · source: NVD
H1
Honor 10 Lite Firmware · Huawei
before 10.0.0.182\(c675e17r2p2\) · source: NVD
LF
Lelandp-l22a Firmware · Huawei
before 9.1.0.166\(c675e5r1p4t8\) · source: NVD
TF
Tc5200-16 Firmware · Huawei
before 10.0.2.8 · source: NVD
Affected product
AF
Anne-al00 Firmware
Huawei
More from Anne-al00 Firmware
7.8
CVE-2019-2215
Android Kernel Use-After-Free Vulnerability
4.6
CVE-2019-19412
Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability
2.4
CVE-2018-7924
Anne-AL00 Huawei phones with versions earlier than 8.0.0.151(C00) have an information leak vulnerability