Low severity · published May 15, 2020
CVE-2020-9073
Huawei P20 smartphones with versions earlier than 10.0.0.156(C00E156R1P4) have an improper authentication vulnerability
2.4
CVSS
0.2%
EPSS
No
On KEV
Description
Huawei P20 smartphones with versions earlier than 10.0.0.156(C00E156R1P4) have an improper authentication vulnerability. The vulnerability is due to that when an user wants to do certain operation, the software insufficiently validate the user's identity. Attackers need to physically access the smartphone to exploit this vulnerability. Successful exploit could allow the attacker to bypass the limit of student mode function.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
P20 Firmware · Huawei
before 10.0.0.156\(c00e156r1p4\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9073
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9073
Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200513-01-smartphone-en
More from P20 Firmware
7.8
CVE-2019-2215
Android Kernel Use-After-Free Vulnerability
8.8
CVE-2020-0022
In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation
5.9
CVE-2018-7987
There is an out-of-bounds write vulnerability on Huawei P20 smartphones with versions before 8.1.0.171(C00)
5.7
CVE-2019-5211
The Huawei Share function of P20 phones with versions earlier than Emily-L29C 9.1.0.311 has an improper file management vulnerability
5.5
CVE-2020-9239
Huawei smartphones BLA-A09 versions 8.0.0.123(C212),versions earlier than 8.0.0.123(C567),versions earlier than 8.0.0.123(C797);BLA-TL00B versions earlier than…