CVE-2020-9223 Denial of service in HONOR 20 PRO

High 7.5 Published 29 Dec 2020 Updated 4 Aug 2024

Remote attackers can cause a denial of service on specific modules of Huawei smartphones by sending abnormal messages.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-9223?

CVE-2020-9223 is a high-severity denial of service vulnerability in HONOR 20 PRO, published on 29 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

There is a denial of service vulnerability in some Huawei smartphones. Due to the improper processing of received abnormal messages, remote attackers may exploit this vulnerability to cause a denial of service (DoS) on the specific module.

Which versions are affected by CVE-2020-9223?

It affects 4 products.

Products include Huawei Honor 20 Pro Firmware, Huawei Princeton-Al10d Firmware, Huawei Yale-L21a Firmware, Huawei Yale-L61a Firmware.

How do I fix CVE-2020-9223?

No fix has been published for CVE-2020-9223 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-9223 being exploited?

There is no known exploitation of CVE-2020-9223 in the wild and no public exploit code.

CVE-2020-9235 Information disclosure in HONOR 20 PRO;Honor View 20;OxfordS-AN00A;Princeton-AL10B;Princeton-AL10D;Princeton-TL10C;Tony-AL00B;Yale-AL00A;Yale-L21A;Yale-L61A Medium 5.5

Sources

Also known as GHSA-m36c-qvvp-5mjx.