Lucene search

Huawei TechnologiesHUAWEI-SA-20200415-01-SMARTPHONE

HistoryApr 15, 2020 - 12:00 a.m.

Security Advisory - Improper Authentication Vulnerability in Some Huawei Smartphones

2020-04-1500:00:00

Huawei Technologies

www.huawei.com

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

29.8%

JSON

There is an improper authentication vulnerability in some Huawei smartphones. The software insufficiently validate the user’s identity when a user wants to do certain operation. An attacker can trick user into installing a malicious application to exploit this vulnerability. Successful exploit may cause some information disclosure. (Vulnerability ID: HWPSIRT-2020-01406)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9070.

Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200415-01-smartphone-en

Affected configurations

Vulners

Node

huaweimate_30_firmwareRange<10.0.0.205

huaweimate_30_pro_firmwareRange<10.0.0.203

huaweimate_30_5g_firmwareRange<10.0.0.203

huaweimate_30_pro_5g_firmwareRange<10.0.0.203

VendorProductVersionCPE
huaweimate_30_firmware*cpe:2.3:o:huawei:mate_30_firmware:*:*:*:*:*:*:*:*
huaweimate_30_pro_firmware*cpe:2.3:o:huawei:mate_30_pro_firmware:*:*:*:*:*:*:*:*
huaweimate_30_5g_firmware*cpe:2.3:o:huawei:mate_30_5g_firmware:*:*:*:*:*:*:*:*
huaweimate_30_pro_5g_firmware*cpe:2.3:o:huawei:mate_30_pro_5g_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	mate_30_firmware	*	cpe:2.3:o:huawei:mate_30_firmware::::::::
huawei	mate_30_pro_firmware	*	cpe:2.3:o:huawei:mate_30_pro_firmware::::::::
huawei	mate_30_5g_firmware	*	cpe:2.3:o:huawei:mate_30_5g_firmware::::::::
huawei	mate_30_pro_5g_firmware	*	cpe:2.3:o:huawei:mate_30_pro_5g_firmware::::::::

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

29.8%

JSON

Related for HUAWEI-SA-20200415-01-SMARTPHONE