VulnerabilityModified

CVE-2020-9109

There is an information disclosure vulnerability in several smartphones.

MEDIUM 4.6EPSS 0.22%

Does this matter?

Lower severity and a low EPSS score (0.22%). Track it; it rarely justifies an emergency change on its own.

Description

There is an information disclosure vulnerability in several smartphones. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario, the attacker need to gain certain information in the victim's smartphone to launch the attack, and successful exploit could cause information disclosure.Affected product versions include:HUAWEI Mate 20 versions earlier than 10.1.0.160(C00E160R3P8),versions earlier than 10.1.0.160(C01E160R2P8);HUAWEI Mate 20 X versions earlier than 10.1.0.160(C00E160R2P8),versions earlier than 10.1.0.160(C01E160R2P8);HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8);Laya-AL00EP versions earlier than 10.1.0.160(C786E160R3P8);Tony-AL00B versions earlier than 10.1.0.160(C00E160R2P11);Tony-TL00B versions earlier than 10.1.0.160(C01E160R2P11).

CVSS 3.1: 4.6 MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.22% probability · 13th percentile
CISA KEV: Not listed
Weakness: CWE-287
Affected: huawei/mate 20 firmware · huawei/mate 20 x firmware · huawei/p30 pro firmware · huawei/laya-al00ep firmware · huawei/tony-al00b firmware · huawei/tony-tl00b firmware
Source: psirt@huawei.com

References

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-dos-enVendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-dos-enVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.