CVE-2020-0069
Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 3 May 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.37% probability · 72th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Listed 3 November 2021 · due 3 May 2022
- Weakness
- CWE-787
- Affected
- google/android · huawei/berkeley-l09 firmware · huawei/columbia-al10b firmware · huawei/columbia-l29d firmware · huawei/columbia-tl00b firmware · huawei/columbia-tl00d firmware · huawei/cornell-al00a firmware · huawei/cornell-tl10b firmware · huawei/dura-al00a firmware · huawei/honor 20 pro firmware · huawei/y6 2019 firmware · huawei/nova 3 firmware · huawei/nova 4 firmware · huawei/honor 8a firmware · huawei/honor view 20 firmware · huawei/jakarta-al00a firmware · huawei/katyusha-al00a firmware · huawei/katyusha-al10a firmware · huawei/madrid-al00a firmware · huawei/paris-l29b firmware · +9 more
- Source
- security@android.com
EPSS 1.4% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
CISA notes
Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-0069
References
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-mtk-enVendor Advisory
- https://source.android.com/security/bulletin/2020-03-01Vendor Advisory
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-mtk-enVendor Advisory
- https://source.android.com/security/bulletin/2020-03-01Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0069Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.