Low severity · published Dec 20, 2024
CVE-2020-9250
There is an insufficient authentication vulnerability in some Huawei smart phone
3.3
CVSS
0.1%
EPSS
No
On KEV
Description
There is an insufficient authentication vulnerability in some Huawei smart phone. An unauthenticated, local attacker can crafts software package to exploit this vulnerability. Due to insufficient verification, successful exploitation may impact the service. (Vulnerability ID: HWPSIRT-2019-12302)
This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9250.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HM
HUAWEI Mate 20 Pro · Huawei
Versions earlier than 10.1.0.160(C00E160R3P8) · source: vendor
M2
Mate 20 Pro Firmware · Huawei
10.1.0.160(c00e160r3p8) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9250
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9250
Broken Link
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200729-01-smartphone-en
More from HUAWEI Mate 20 Pro
7.8
CVE-2020-9080
There is an improper privilege management vulnerability in Huawei smart phone product