Medium severity · published Dec 24, 2020
CVE-2020-9119
There is a privilege escalation vulnerability on some Huawei smart phones due to design defects
6.2
CVSS
0.2%
EPSS
No
On KEV
Description
There is a privilege escalation vulnerability on some Huawei smart phones due to design defects. The attacker needs to physically contact the mobile phone and obtain higher privileges, and execute relevant commands, resulting in the user's privilege promotion.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
M1
Mate 10 Firmware · Huawei
before 10.0.0.189\(c185e6r1p3\) · source: NVD
M3
Mate 30 Firmware · Huawei
before 10.1.0.156\(c00e155r7p2\) · source: NVD
M3
Mate 30 Pro Firmware · Huawei
before 10.1.0.156\(c00e156r7p2\) · source: NVD
PF
P40 Firmware · Huawei
before 10.1.0.150\(sp1c00e150r4p1\) · source: NVD
PP
P40 Pro Firmware · Huawei
before 10.1.0.150\(sp1c00e150r4p1\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9119
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9119
Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201202-01-smartphone-en
More from Mate 10 Firmware
8.8
CVE-2017-15311
The baseband modules of Mate 10, Mate 10 Pro, Mate 9, Mate 9 Pro Huawei smart phones with software before ALP-AL00 8.0.0.120(SP2C00), before BLA-AL00 8.0.0.120(SP2C00), before…
7.8
CVE-2018-7993
HUAWEI Mate 10 smartphones with versions earlier than ALP-AL00 8.1.0.311 have a use after free vulnerability on mediaserver component
7.8
CVE-2017-17227
GPU driver in Huawei Mate 10 smart phones with the versions before ALP-L09 8.0.0.120(C212); The versions before ALP-L09 8.0.0.127(C900); The versions before ALP-L09…
5.5
CVE-2019-5305
The image processing module of some Huawei Mate 10 smartphones versions before ALP-L29 9.0.0.159(C185) has a memory double free vulnerability
5.5
CVE-2019-5219
There is a double free vulnerability on certain drivers of Huawei Mate10 smartphones versions earlier than ALP-AL00B 9.0.0.181(C00E87R2P20T8)