Information disclosure in Huawei products - CVE-2020-9102

Vulnerability identifier: #VU30119

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-9102

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to the improper management of the username. A local attacker can gain unauthorized access to sensitive information on the system.

Huawei CloudEngine 12800
Huawei CloudEngine 7800
Huawei CloudEngine 5800
Huawei CloudEngine 6800

Install updates from vendor's website.

Huawei CloudEngine 12800 - update to V200R019C10SPC800
Huawei CloudEngine 7800 - update to V200R019C10SPC800
Huawei CloudEngine 5800 - update to V200R019C10SPC800
Huawei CloudEngine 6800 - update to V200R019C10SPC800

• https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-03-informationleak-en

• Multiple vulnerabilities in some Huawei Products