Read the docs
TI-2020-07286 Aliases CVE-2020-9073GHSA-48xv-3rm6-fh3c

Improper authentication in P20

Priority LOW 12CWE-287Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

Huawei P20 smartphones with versions earlier than 10.0.0.156(C00E156R1P4) have an improper authentication vulnerability. The vulnerability is due to that when an user wants to do certain operation, the software insufficiently validate the user's identity. Attackers need to physically access the smartphone to exploit this vulnerability. Successful exploit could allow the attacker to bypass the limit of student mode function.

Why it matters now

EPSS 0.00222 12th percentileScored 2026-11-07
Fix Fixed P20: 10.0.0.156(C00E156R1P4)

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—P20before 10.0.0.156(C00E156R1P4)10.0.0.156(C00E156R1P4)Patch availableCNA
  • P20 Vendor— Affected before 10.0.0.156(C00E156R1P4) Fixed in 10.0.0.156(C00E156R1P4) Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:huawei:p20_firmware:*:*:*:*:*:*:*:*before 10.0.0.156\(c00e156r1p4\)VulnerableHuawei
cpe:2.3:h:huawei:p20:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
  • cpe:2.3:o:huawei:p20_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.156\(c00e156r1p4\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:p20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei

Remediation

  • Fix · CNA P20 Fixed in 10.0.0.156(C00E156R1P4)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-9073
  2. 2026-10-03 Alias added: GHSA-48xv-3rm6-fh3c

References

Advisory 1

  • TI-2019-01829 Use after free in Android KEVCVSS 3.1HIGH 7.8
  • TI-2020-00021 In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write… CVSS 3.1HIGH 8.8
  • TI-2019-06941 Cryptographic flaw in Bluetooth BR/EDR CVSS 3.1HIGH 8.1
  • TI-2018-05764 Out-of-bounds write in Huawei P20 CVSS 3.0MEDIUM 5.9
  • TI-2019-03665 Improper input validation in P20 Pro, P20, Mate RS CVSS 3.1MEDIUM 5.5
  • TI-2019-03647 Incorrect permission assignment in P20 CVSS 3.1MEDIUM 5.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences