Medium severity · published Dec 27, 2024
CVE-2020-9081
There is an improper authorization vulnerability in some Huawei smartphones
6.8
CVSS
0.2%
EPSS
No
On KEV
Description
There is an improper authorization vulnerability in some Huawei smartphones. An attacker could perform a series of operation in specific mode to exploit this vulnerability. Successful exploit could allow the attacker to bypass app lock. (Vulnerability ID: HWPSIRT-2019-12144)
This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9081.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HM
HUAWEI Mate 20 · Huawei
Versions earlier than 10.1.0.160(C00E160R3P8); Versions earlier than 10.1.0.160(C01E160R2P8) · source: vendor
HP
HUAWEI P30 · Huawei
Versions earlier than 10.1.0.160(C00E160R2P11) · source: vendor
HP
HUAWEI P30 Pro · Huawei
Versions earlier than 10.1.0.160(C00E160R2P8); Versions earlier than 10.1.0.160(C01E160R2P8) · source: vendor
PR
Princeton-AL10D · Huawei
Versions earlier than 10.1.0.160(C00E160R2P11) · source: vendor
YA
Yale-AL00A · Huawei
Versions earlier than 10.1.0.160(C00E160R8P12) · source: vendor
YA
Yale-AL50A · Huawei
Versions earlier than 10.1.0.88(C00E88R8P1) · source: vendor
YA
YaleP-AL10B · Huawei
Versions earlier than 10.1.0.160(C00E160R8P12) · source: vendor
M2
Mate 20 Firmware · Huawei
before 10.1.0.160\(c00e160r3p8\); before 10.1.0.160\(c01e160r2p8\) · source: NVD
PF
P30 Firmware · Huawei
before 10.1.0.160\(c00e160r2p11\) · source: NVD
PP
P30 Pro Firmware · Huawei
before 10.1.0.160\(c00e160r2p8\); before 10.1.0.160\(c01e160r2p8\) · source: NVD
PF
Princeton-al10d Firmware · Huawei
before 10.1.0.160\(c00e160r2p11\) · source: NVD
YF
Yale-al00a Firmware · Huawei
before 10.1.0.160\(c00e160r8p12\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9081
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9081
Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200826-15-smartphone-en
More from HUAWEI Mate 20
4.6
CVE-2020-9082
There is an information disclosure vulnerability in several smartphones