CVE-2020-9077 Auth bypass in HUAWEI P30

Low 3.3 Published 27 Jul 2020 Updated 4 Aug 2024

Attackers can obtain device information by tricking users into installing malicious software due to improper authentication of an interface.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2020-9077?

CVE-2020-9077 is a low-severity authentication bypass vulnerability in HUAWEI P30, published on 27 Jul 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

HUAWEI P30 smart phones with versions earlier than 10.1.0.160(C00E160R2P11) have an information exposure vulnerability. The system does not properly authenticate the application that access a specified interface. Attackers can trick users into installing malicious software to exploit this vulnerability and obtain some information about the device. Successful exploit may cause information disclosure.

Weakness: CWE-287

Which versions are affected by CVE-2020-9077?

It affects 1 product.

Products include Huawei P30 Firmware.

How do I fix CVE-2020-9077?

No fix has been published for CVE-2020-9077 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-9077 being exploited?

There is no known exploitation of CVE-2020-9077 in the wild and no public exploit code.

Sources

Also known as GHSA-35hp-m7hg-c3cm.