Information disclosure in Huawei products - CVE-2020-9239

Vulnerability identifier: #VU46578

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-9239

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to a module has a design error that is lack of control of input. A local attacker can gain unauthorized access to sensitive information on the system.

Huawei Berkeley-L09
Huawei P20
Huawei P20 Pro
BLA-A09
BLA-TL00B
Jimmy-AL00A
NEO-AL00D
Toronto-AL00
Toronto-AL00A
Toronto-TL10
Stanford-AL00
Duke-L09
LON-L29D

Install updates from vendor's website.

Huawei Berkeley-L09 - addressed in versions 8.0.0.163(C10), 8.0.0.163(C432), 8.0.0.163(C636), 8.0.0.172(C10)
BLA-A09 - addressed in versions 8.0.0.123(C567), 8.0.0.123(C797)
BLA-TL00B - update to 8.1.0.326(C01)
Huawei P20 - update to 8.0.1.16(C00)
Huawei P20 Pro - update to 8.1.0.152(C00)
Jimmy-AL00A - update to Jimmy-AL00AC00B172
NEO-AL00D - update to 8.1.0.172(C786)
Toronto-AL00 - update to Toronto-AL00AC00B225
Toronto-AL00A - update to Toronto-AL00AC00B225
Toronto-TL10 - update to Toronto-TL10C01B225
Stanford-AL00 - update to STF-AL10 8.0.0.355(C00GT)
Duke-L09 - addressed in versions DUK-L09 8.0.0.366(C636), DUK-L09 8.0.0.368(C10), DUK-L09 8.0.0.369(C432)
LON-L29D - update to 8.0.0.368(C721)

• https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200909-04-smartphone-en

• Information disclosure in Huawei products