Medium severity · published Oct 12, 2020
CVE-2020-9109
There is an information disclosure vulnerability in several smartphones
4.6
CVSS
0.2%
EPSS
No
On KEV
Description
There is an information disclosure vulnerability in several smartphones. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario, the attacker need to gain certain information in the victim's smartphone to launch the attack, and successful exploit could cause information disclosure.Affected product versions include:HUAWEI Mate 20 versions earlier than 10.1.0.160(C00E160R3P8),versions earlier than 10.1.0.160(C01E160R2P8);HUAWEI Mate 20 X versions earlier than 10.1.0.160(C00E160R2P8),versions earlier than 10.1.0.160(C01E160R2P8);HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8);Laya-AL00EP versions earlier than 10.1.0.160(C786E160R3P8);Tony-AL00B versions earlier than 10.1.0.160(C00E160R2P11);Tony-TL00B versions earlier than 10.1.0.160(C01E160R2P11).
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LF
Laya-al00ep Firmware · Huawei
before 10.1.0.160\(c786e160r3p8\) · source: NVD
M2
Mate 20 Firmware · Huawei
before 10.1.0.160\(c00e160r3p8\); before 10.1.0.160\(c01e160r2p8\) · source: NVD
M2
Mate 20 X Firmware · Huawei
before 10.1.0.160\(c00e160r2p8\); before 10.1.0.160\(c01e160r2p8\) · source: NVD
PP
P30 Pro Firmware · Huawei
before 10.1.0.160\(c00e160r2p8\) · source: NVD
TF
Tony-al00b Firmware · Huawei
before 10.1.0.160\(c00e160r2p11\) · source: NVD
TF
Tony-tl00b Firmware · Huawei
before 10.1.0.160\(c01e160r2p11\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9109
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9109
Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-dos-en
More from Laya-al00ep Firmware
7.8
CVE-2020-9247
There is a buffer overflow vulnerability in several Huawei products
5.3
CVE-2019-5235
Some Huawei smart phones have a null pointer dereference vulnerability
4.6
CVE-2021-22440
There is a path traversal vulnerability in some Huawei products