Auth bypass in Huawei P20
CVE-2020-9073
Huawei P20 smartphones with versions earlier than 10.0.0.156(C00E156R1P4) have an improper authentication vulnerability. The vulnerability is due to that when an user wants to do certain operation, the software insufficiently validate the user's identity. Attackers need to physically access the smartphone to exploit this vulnerability. Successful exploit could allow the attacker to bypass the limit of student mode function.
Vulnerability class: Broken Authentication
EPSS: 0.002 (13.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 2.4 (Low). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Huawei P20
- Huawei P20_firmware
- N/a P20 — versions Versions earlier than 10.0.0.156(C00E156R1P4)
Weakness classification (CWE)
References
- psirt@huawei.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-9073?
- CVE-2020-9073 is a low-severity vulnerability in Huawei P20, classified under Improper Authentication. CVSS score: 2.4/10. Published 2020-05-15.
- How severe is CVE-2020-9073?
- Low severity. CVSS v3 base score is 2.4 out of 10.