{"id":"CVE-2020-0069","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-0069","generatedAt":"2026-10-28T00:32:31.146Z","title":"Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability","description":"In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754","published":"2020-03-10T20:15:22.000Z","lastModified":"2026-06-17T02:45:11.000Z","status":"Analyzed","sourceIdentifier":"security@android.com","cvss":{"version":"3.1","score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-787"],"affected":["google/android","huawei/berkeley-l09 firmware","huawei/columbia-al10b firmware","huawei/columbia-l29d firmware","huawei/columbia-tl00b firmware","huawei/columbia-tl00d firmware","huawei/cornell-al00a firmware","huawei/cornell-tl10b firmware","huawei/dura-al00a firmware","huawei/honor 20 pro firmware","huawei/y6 2019 firmware","huawei/nova 3 firmware","huawei/nova 4 firmware","huawei/honor 8a firmware","huawei/honor view 20 firmware","huawei/jakarta-al00a firmware","huawei/katyusha-al00a firmware","huawei/katyusha-al10a firmware","huawei/madrid-al00a firmware","huawei/paris-l29b firmware","huawei/princeton-al10b firmware","huawei/sydney-al00 firmware","huawei/sydney-tl00 firmware","huawei/sydneym-al00 firmware","huawei/tony-al00b firmware","huawei/tony-tl00b firmware","huawei/yale-al00a firmware","huawei/yale-l21a firmware","huawei/yalep-al10b firmware"],"epss":{"score":0.0137,"percentile":0.71726,"date":"2026-10-26","history":[]},"kev":{"listed":true,"dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","notes":"Apply updates per vendor instructions.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-0069"},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 3 May 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-mtk-en","tags":["Vendor Advisory"],"source":"security@android.com"},{"url":"https://source.android.com/security/bulletin/2020-03-01","tags":["Vendor Advisory"],"source":"security@android.com"},{"url":"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-mtk-en","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://source.android.com/security/bulletin/2020-03-01","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0069","tags":["Third Party Advisory","US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-0069","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}