CVE-2020-9076 Auth bypass in HUAWEI P30;HUAWEI P30 Pro;Tony-AL00B

Medium 6.8 Published 15 Jun 2020 Updated 4 Aug 2024

Attackers can bypass sender identity verification via man-in-the-middle attacks to trick users into accessing malicious URLs on Huawei smartphones.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2020-9076?

CVE-2020-9076 is a medium-severity authentication bypass vulnerability in HUAWEI P30;HUAWEI P30 Pro;Tony-AL00B, published on 15 Jun 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

HUAWEI P30;HUAWEI P30 Pro;Tony-AL00B smartphones with versions earlier than 10.1.0.135(C00E135R2P11); versions earlier than 10.1.0.135(C00E135R2P8), versions earlier than 10.1.0.135 have an improper authentication vulnerability. Due to the identity of the message sender not being properly verified, an attacker can exploit this vulnerability through man-in-the-middle attack to induce user to access malicious URL.

Weakness: CWE-287

Which versions are affected by CVE-2020-9076?

It affects 3 products.

Products include Huawei P30 Firmware, Huawei P30 Pro Firmware, Huawei Tony-Al00b Firmware.

How do I fix CVE-2020-9076?

No fix has been published for CVE-2020-9076 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-9076 being exploited?

There is no known exploitation of CVE-2020-9076 in the wild and no public exploit code.

Sources

Also known as GHSA-c399-vcg7-52h3.