PT-2020-20477 · Huawei · Tony-Al00B+2

Published 2020-06-15 · Updated 2020-06-20 · CVE-2020-9076

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions HUAWEI P30 versions earlier than 10.1.0.135 HUAWEI P30 Pro versions earlier than 10.1.0.135 Tony-AL00B smartphones versions earlier than 10.1.0.135

Description The issue is related to an improper authentication vulnerability. Due to the identity of the message sender not being properly verified, an attacker can exploit this vulnerability through a man-in-the-middle attack to induce the user to access a malicious URL.

Recommendations For HUAWEI P30 versions earlier than 10.1.0.135, update to version 10.1.0.135 or later. For HUAWEI P30 Pro versions earlier than 10.1.0.135, update to version 10.1.0.135 or later. For Tony-AL00B smartphones versions earlier than 10.1.0.135, update to version 10.1.0.135 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-9076

Affected Products

Huawei P30

Huawei P30 Pro

Tony-Al00B

References · 4

• https://osv.dev/vulnerability/CVE-2020-9076 · Vendor Advisory
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20200610-02-phone-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9076 · Security Note
• https://t.me/cvenotify/4373 · Telegram Post