Permissions, Privileges, and Access Controls in Huawei products - CVE-2020-9119

Vulnerability identifier: #VU48797

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-9119

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user  to escalate privileges on the system.

The vulnerability exists due to design defects. An administrator with physical access can execute relevant commands and escalate privileges on the target system.

Huawei Mate 10
Huawei Mate 30
Huawei Mate 30 Pro
Huawei P40
Huawei P40 Pro

Install updates from vendor's website.

Huawei Mate 10 - update to 10.0.0.189(C185E6R1P3)
Huawei Mate 30 - update to 10.1.0.156(C00E155R7P2)
Huawei Mate 30 Pro - update to 10.1.0.156(C00E156R7P2)
Huawei P40 - update to 10.1.0.150(SP1C00E150R4P1)
Huawei P40 Pro - update to 10.1.0.150(SP1C00E150R4P1)

• https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201202-01-smartphone-en

• Privilege escalation in several Huawei Smartphones