CVE-2020-1812 Auth bypass in HUAWEI P30

High 7.8 Published 18 Feb 2020 Updated 4 Aug 2024

An attacker can bypass authentication on Huawei P30 devices by tricking users into installing a malicious application, allowing unauthorized operations.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2020-1812?

CVE-2020-1812 is a high-severity authentication bypass vulnerability in HUAWEI P30, published on 18 Feb 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

HUAWEI P30 smartphones with versions earlier than 10.0.0.173(C00E73R1P11) have an improper authentication vulnerability. Due to improperly validation of certain application, an attacker should trick the user into installing a malicious application to exploit this vulnerability. Successful exploit could allow the attacker to bypass the authentication to perform unauthorized operations.

Weakness: CWE-287

Which versions are affected by CVE-2020-1812?

It affects 1 product.

Products include Huawei P30 Firmware.

How do I fix CVE-2020-1812?

No fix has been published for CVE-2020-1812 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-1812 being exploited?

There is no known exploitation of CVE-2020-1812 in the wild and no public exploit code.

Sources

Also known as GHSA-vf7f-rm6p-4f56.