Read the docs
TI-2020-01746 Aliases CVE-2020-1808GHSA-qvqw-f2fv-45jw

Out-of-bounds read in Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI…

Priority LOW 32CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI P30;HUAWEI P30 Pro;Honor View 20 smartphones with versions earlier than 10.0.0.187(C00E60R4P11); versions earlier than 10.0.0.187(C00E60R4P11); versions earlier than 10.0.0.176(C00E60R2P11);9.1.0.135(C00E133R2P1); versions earlier than 10.1.0.123(C431E22R3P5), versions earlier than 10.1.0.126(C636E5R3P4), versions earlier than 10.1.0.160(C00E160R2P11); versions earlier than 10.1.0.126(C185E8R5P1), versions earlier than 10.1.0.126(C636E9R2P4), versions earlier than 10.1.0.160(C00E160R2P8); versions earlier than 10.0.0.179(C636E3R4P3), versions earlier than 10.0.0.180(C185E3R3P3), versions earlier than 10.0.0.180(C432E10R3P4), versions earlier than 10.0.0.181(C675E5R1P2) have an out of bound read vulnerability. The software reads data past the end of the intended buffer. The attacker tricks the user into installing a crafted application, successful exploit may cause information disclosure or service abnormal.

Why it matters now

EPSS 0.0054 45th percentileScored 2026-11-07
Fix Fixed Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI P30;HUAWEI P30 Pro;Honor View 20: 10.0.0.187(C00E60R4P11), 10.0.0.176(C00E60R2P11)

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI P30;HUAWEI P30 Pro;Honor View 20before 10.0.0.187(C00E60R4P11); before 10.0.0.176(C00E60R2P11); 9.1.0.135(C00E133R2P1); Versions earlier than 10.1.0.123(C431E22R3P5),Versions earlier than 10.1.0.126(C636E5R3P4),Versions earlier than 10.1.0.160(C00E160R2P11); Versions earlier than 10.1.0.126(C185E8R5P1),Versions earlier than 10.1.0.126(C636E9R2P4),Versions earlier than 10.1.0.160(C00E160R2P8); Versions earlier than 10.0.0.179(C636E3R4P3),Versions earlier than 10.0.0.180(C185E3R3P3),Versions earlier than 10.0.0.180(C432E10R3P4),Versions earlier than 10.0.0.181(C675E5R1P2)10.0.0.187(C00E60R4P11), 10.0.0.176(C00E60R2P11)Patch availableCNA
  • Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI P30;HUAWEI P30 Pro;Honor View 20 Vendor— Affected before 10.0.0.187(C00E60R4P11); before 10.0.0.176(C00E60R2P11); 9.1.0.135(C00E133R2P1); Versions earlier than 10.1.0.123(C431E22R3P5),Versions earlier than 10.1.0.126(C636E5R3P4),Versions earlier than 10.1.0.160(C00E160R2P11); Versions earlier than 10.1.0.126(C185E8R5P1),Versions earlier than 10.1.0.126(C636E9R2P4),Versions earlier than 10.1.0.160(C00E160R2P8); Versions earlier than 10.0.0.179(C636E3R4P3),Versions earlier than 10.0.0.180(C185E3R3P3),Versions earlier than 10.0.0.180(C432E10R3P4),Versions earlier than 10.0.0.181(C675E5R1P2) Fixed in 10.0.0.187(C00E60R4P11), 10.0.0.176(C00E60R2P11) Patch available CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:*before 10.0.0.179\(c636e3r4p3\)VulnerableHuawei
cpe:2.3:h:huawei:honor_view_20:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:*before 10.0.0.180\(c185e3r3p3\); before 10.0.0.180\(c432e10r3p4\); before 10.0.0.188\(c00e62r2p11\)VulnerableHuawei
cpe:2.3:o:huawei:honor_20_firmware:*:*:*:*:*:*:*:*before 10.0.0.187\(c00e60r4p11\)VulnerableHuawei
cpe:2.3:h:huawei:honor_20:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:honor_20_pro_firmware:*:*:*:*:*:*:*:*before 10.0.0.187\(c00e60r4p11\)VulnerableHuawei
cpe:2.3:h:huawei:honor_20_pro:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:honor_magic2_firmware:*:*:*:*:*:*:*:*before 10.0.0.176\(c00e60r2p11\)VulnerableHuawei
cpe:2.3:h:huawei:honor_magic2:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
  • cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.179\(c636e3r4p3\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:honor_view_20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.180\(c185e3r3p3\); before 10.0.0.180\(c432e10r3p4\); before 10.0.0.188\(c00e62r2p11\) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:honor_20_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.187\(c00e60r4p11\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:honor_20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:honor_20_pro_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.187\(c00e60r4p11\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:honor_20_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:honor_magic2_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.176\(c00e60r2p11\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:honor_magic2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei

Remediation

  • Fix · CNA Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI P30;HUAWEI P30 Pro;Honor View 20 Fixed in 10.0.0.187(C00E60R4P11), 10.0.0.176(C00E60R2P11)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-1808
  2. 2026-10-03 Alias added: GHSA-qvqw-f2fv-45jw

References

Advisory 1

  • TI-2019-06941 Cryptographic flaw in Bluetooth BR/EDR CVSS 3.1HIGH 8.1
  • TI-2020-07385 HUAWEI Mate 20 versions Versions earlier than 10.1.0.160(C00E160R3P8);HUAWEI Mate 20 Pro… CVSS 3.1MEDIUM 6.8
  • TI-2020-07287 Improper handling of exceptional conditions in HONOR 20 PRO CVSS 3.1MEDIUM 5.3
  • TI-2019-03732 Improper input validation in Huawei ALP-AL00B CVSS 3.1MEDIUM 5.3
  • TI-2019-03731 Improper input validation in Huawei Sydney-L21 CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences