CVE-2020-9069 Information disclosure in Anne-AL00

Medium 6.5 Published 21 May 2020 Updated 4 Aug 2024

An unauthenticated adjacent attacker can exploit an information leakage vulnerability to decrypt data and leak information on affected Huawei devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-9069?

CVE-2020-9069 is a medium-severity vulnerability in HUAWEI Anne-AL00, published on 21 May 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

There is an information leakage vulnerability in some Huawei products. An unauthenticated, adjacent attacker could exploit this vulnerability to decrypt data. Successful exploitation may leak information randomly. Affected product versions include: Anne-AL00 Versions earlier than 9.1.0.331(C675E9R1P3T8); Berkeley-L09 Versions earlier than 10.0.1.1(C675R1); CD16-10 Versions earlier than 10.0.2.8; CD17-10 Versions earlier than 10.0.2.8; CD17-16 Versions earlier than 10.0.2.8; CD18-10 Versions earlier than 10.0.2.8; CD18-16 Versions earlier than 10.0.2.8; Columbia-TL00B Versions earlier than 9.0.0.187(C01E181R1P20T8); E6878-370 Versions earlier than 10.0.5.1(H610SP10C00); HUAWEI P30 lite Versions earlier than 10.0.0.185(C605E3R1P3), Versions earlier than 10.0.0.197(C432E8R2P7); HUAWEI nova 4e Versions earlier than 10.0.0.158(C00E64R1P9); Honor 10 Lite 9.0.1.113(C675E11R1P12); LelandP-L22A Versions earlier than 9.1.0.166(C675E5R1P4T8); Marie-AL00AX Versions earlier than 10.0.0.158(C00E64R1P9); Marie-AL00AY Versions earlier than 10.0.0.158(C00E64R1P9); Marie-AL00BX Versions earlier than 10.0.0.158(C00E64R1P9); Marie-L03BX Versions earlier than 10.0.0.188(C605E5R1P1); Marie-L21BX Versions earlier than 10.0.0.188(C432E4R4P1), Versions earlier than 10.0.0.188(C461E5R3P1); Marie-L22BX Versions earlier than 10.0.0.188(C636E3R3P1); Marie-L23BX Versions earlier than 10.0.0.188(C605E5R1P1); TC5200-16 Versions earlier than 10.0.2.8; WS5200-11 Versions earlier than 10.0.2.8; WS5200-12 Versions earlier than 10.0.2.23; WS5200-16 Versions earlier than 10.0.2.8; WS5200-17 Versions earlier than 10.0.2.23; WS5800-10 Versions earlier than 10.0.3.27; WS6500-10 Versions earlier than 10.0.2.8; WS6500-16 Versions earlier than 10.0.2.8

Which versions are affected by CVE-2020-9069?

It affects 18 products.

Products include Huawei Anne-Al00 Firmware, Huawei Berkeley-L09 Firmware, Huawei Cd16-10 Firmware, Huawei Cd17-10 Firmware, Huawei Cd17-16 Firmware, Huawei Cd18-10 Firmware and 12 more.

How do I fix CVE-2020-9069?

No fix has been published for CVE-2020-9069 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-9069 being exploited?

There is no known exploitation of CVE-2020-9069 in the wild and no public exploit code.

CVE-2018-7924 Information disclosure in Anne-AL00 Low 2.4

Sources

Also known as GHSA-4v4h-3w7f-m5wp.