PT-2020-20543 · Huawei · Mate 20 Pro+11

Published 2020-12-07 · Updated 2020-12-08 · CVE-2020-9247

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Huawei HONOR 20 PRO (affected versions not specified) Huawei Mate 20 (affected versions not specified) Huawei Mate 20 Pro (affected versions not specified) Huawei Mate 20 X (affected versions not specified) Huawei P30 (affected versions not specified) Huawei P30 Pro (affected versions not specified) Huawei Hima-L29C (affected versions not specified) Huawei Laya-AL00EP (affected versions not specified) Huawei Princeton-AL10B (affected versions not specified) Huawei Tony-AL00B (affected versions not specified) Huawei Yale-L61A (affected versions not specified) Huawei Yale-TL00B (affected versions not specified) Huawei YaleP-AL10B (affected versions not specified)

Description The system does not sufficiently validate certain configuration parameters passed from the user, which can cause a buffer overflow. An attacker may trick the user into installing and running a malicious application with high privileges, potentially leading to code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2020-9247

Affected Products

Honor 20 Pro

Hima-L29C

Laya-Al00Ep

Mate 20 X

Mate 20 Pro

P30

P30 Pro

Princeton-Al10B

Tony-Al00B

Yale-L61A

Yale-Tl00B

Yalep-Al10B

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-9247 · Security Note
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20200729-03-smartphone-en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9247 · Vendor Advisory
• https://t.me/cibsecurity/17184 · Telegram Post
• https://t.me/cvenotify/6731 · Telegram Post
• https://t.me/cvenotify/6651 · Telegram Post