CVE-2020-9235 Information disclosure in HONOR 20 PRO;Honor View 20;OxfordS-AN00A;Princeton-AL10B;Princeton-AL10D;Princeton-TL10C;Tony-AL00B;Yale-AL00A;Yale-L21A;Yale-L61A
Attackers can exploit a design error in a module to obtain sensitive information, leading to an information leak on affected Huawei smartphones.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-9235?
CVE-2020-9235 is a medium-severity vulnerability in HONOR 20 PRO;Honor View 20;OxfordS-AN00A;Princeton-AL10B;Princeton-AL10D;Princeton-TL10C;Tony-AL00B;Yale-AL00A;Yale-L21A;Yale-L61A, published on 3 Sep 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Huawei smartphones HONOR 20 PRO Versions earlier than 10.1.0.230(C432E9R5P1),Versions earlier than 10.1.0.231(C10E3R3P2),Versions earlier than 10.1.0.231(C185E3R5P1),Versions earlier than 10.1.0.231(C636E3R3P1);Versions earlier than 10.1.0.212(C432E10R3P4),Versions earlier than 10.1.0.213(C636E3R4P3),Versions earlier than 10.1.0.214(C10E5R4P3),Versions earlier than 10.1.0.214(C185E3R3P3);Versions earlier than 10.1.0.212(C00E210R5P1);Versions earlier than 10.1.0.160(C00E160R2P11);Versions earlier than 10.1.0.160(C00E160R2P11);Versions earlier than 10.1.0.160(C01E160R2P11);Versions earlier than 10.1.0.160(C00E160R2P11);Versions earlier than 10.1.0.160(C00E160R8P12);Versions earlier than 10.1.0.230(C432E9R5P1),Versions earlier than 10.1.0.231(C10E3R3P2),Versions earlier than 10.1.0.231(C636E3R3P1);Versions earlier than 10.1.0.225(C431E3R1P2),Versions earlier than 10.1.0.225(C432E3R1P2) contain an information vulnerability. A module has a design error that is lack of control of input. Attackers can exploit this vulnerability to obtain some information. This can lead to information leak.
Weakness: CWE-20
Which versions are affected by CVE-2020-9235?
It affects 10 products.
Products include Huawei Honor 20 Pro Firmware, Huawei Honor View 20 Firmware, Huawei Oxfords-An00a Firmware, Huawei Princeton-Al10b Firmware, Huawei Princeton-Al10d Firmware, Huawei Princeton-Tl10c Firmware and 4 more.
How do I fix CVE-2020-9235?
No fix has been published for CVE-2020-9235 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-9235 being exploited?
There is no known exploitation of CVE-2020-9235 in the wild and no public exploit code.
Other vulnerabilities in HONOR 20 PRO;Honor View 20;OxfordS-AN00A;Princeton-AL10B;Princeton-AL10D;Princeton-TL10C;Tony-AL00B;Yale-AL00A;Yale-L21A;Yale-L61A
Sources
Also known as GHSA-46w2-3f5r-88m4.