Read the docs
TI-2020-07294 Aliases CVE-2020-9081GHSA-hc6q-5pvq-h8ff

Improper authorization in HUAWEI Mate 20

Priority LOW 29CWE-285Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-285.

Summary

There is an improper authorization vulnerability in some Huawei smartphones. An attacker could perform a series of operation in specific mode to exploit this vulnerability. Successful exploit could allow the attacker to bypass app lock. (Vulnerability ID: HWPSIRT-2019-12144) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9081.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00202 10th percentileScored 2026-11-07
Fix Fixed HUAWEI Mate 20 (Huawei): 10.1.0.160(C00E160R3P8), 10.1.0.160(C01E160R2P8)HUAWEI P30 (Huawei): 10.1.0.160(C00E160R2P11)+5 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HuaweiHUAWEI Mate 20before 10.1.0.160(C00E160R3P8); before 10.1.0.160(C01E160R2P8)10.1.0.160(C00E160R3P8), 10.1.0.160(C01E160R2P8)Patch availableCNA
HuaweiHUAWEI P30before 10.1.0.160(C00E160R2P11)10.1.0.160(C00E160R2P11)Patch availableCNA
HuaweiHUAWEI P30 Probefore 10.1.0.160(C00E160R2P8); before 10.1.0.160(C01E160R2P8)10.1.0.160(C00E160R2P8), 10.1.0.160(C01E160R2P8)Patch availableCNA
HuaweiPrinceton-AL10Dbefore 10.1.0.160(C00E160R2P11)10.1.0.160(C00E160R2P11)Patch availableCNA
HuaweiYale-AL00Abefore 10.1.0.160(C00E160R8P12)10.1.0.160(C00E160R8P12)Patch availableCNA
HuaweiYale-AL50Abefore 10.1.0.88(C00E88R8P1)10.1.0.88(C00E88R8P1)Patch availableCNA
HuaweiYaleP-AL10Bbefore 10.1.0.160(C00E160R8P12)10.1.0.160(C00E160R8P12)Patch availableCNA
  • HUAWEI Mate 20 VendorHuawei Affected before 10.1.0.160(C00E160R3P8); before 10.1.0.160(C01E160R2P8) Fixed in 10.1.0.160(C00E160R3P8), 10.1.0.160(C01E160R2P8) Patch available CNA
  • HUAWEI P30 VendorHuawei Affected before 10.1.0.160(C00E160R2P11) Fixed in 10.1.0.160(C00E160R2P11) Patch available CNA
  • HUAWEI P30 Pro VendorHuawei Affected before 10.1.0.160(C00E160R2P8); before 10.1.0.160(C01E160R2P8) Fixed in 10.1.0.160(C00E160R2P8), 10.1.0.160(C01E160R2P8) Patch available CNA
  • Princeton-AL10D VendorHuawei Affected before 10.1.0.160(C00E160R2P11) Fixed in 10.1.0.160(C00E160R2P11) Patch available CNA
  • Yale-AL00A VendorHuawei Affected before 10.1.0.160(C00E160R8P12) Fixed in 10.1.0.160(C00E160R8P12) Patch available CNA
  • Yale-AL50A VendorHuawei Affected before 10.1.0.88(C00E88R8P1) Fixed in 10.1.0.88(C00E88R8P1) Patch available CNA
  • YaleP-AL10B VendorHuawei Affected before 10.1.0.160(C00E160R8P12) Fixed in 10.1.0.160(C00E160R8P12) Patch available CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:o:huawei:mate_20_firmware:*:*:*:*:*:*:*:*before 10.1.0.160\(c00e160r3p8\)VulnerableHuawei
cpe:2.3:h:huawei:mate_20:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:p30_firmware:*:*:*:*:*:*:*:*before 10.1.0.160\(c00e160r2p11\)VulnerableHuawei
cpe:2.3:h:huawei:p30:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:p30_pro_firmware:*:*:*:*:*:*:*:*before 10.1.0.160\(c00e160r2p8\)VulnerableHuawei
cpe:2.3:h:huawei:p30_pro:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:princeton-al10d_firmware:*:*:*:*:*:*:*:*before 10.1.0.160\(c00e160r2p11\)VulnerableHuawei
cpe:2.3:h:huawei:princeton-al10d:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:yale-al00a_firmware:*:*:*:*:*:*:*:*before 10.1.0.160\(c00e160r8p12\)VulnerableHuawei
cpe:2.3:h:huawei:yale-al00a:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
  • cpe:2.3:o:huawei:mate_20_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.160\(c00e160r3p8\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:mate_20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:p30_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.160\(c00e160r2p11\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:p30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:p30_pro_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.160\(c00e160r2p8\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:p30_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:princeton-al10d_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.160\(c00e160r2p11\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:princeton-al10d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:yale-al00a_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.160\(c00e160r8p12\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:yale-al00a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:huawei:yale-al50a_firmware:*:*:*:*:*:*:*:*before 10.1.0.88\(c00e88r8p1\)VulnerableHuawei
cpe:2.3:h:huawei:yale-al50a:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:yalep-al10b_firmware:*:*:*:*:*:*:*:*before 10.1.0.160\(c00e160r8p12\)VulnerableHuawei
cpe:2.3:h:huawei:yalep-al10b:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:mate_20_firmware:*:*:*:*:*:*:*:*before 10.1.0.160\(c01e160r2p8\)VulnerableHuawei
cpe:2.3:o:huawei:p30_pro_firmware:*:*:*:*:*:*:*:*before 10.1.0.160\(c01e160r2p8\)VulnerableHuawei
  • cpe:2.3:o:huawei:yale-al50a_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.88\(c00e88r8p1\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:yale-al50a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:yalep-al10b_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.160\(c00e160r8p12\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:yalep-al10b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:mate_20_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.160\(c01e160r2p8\) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:p30_pro_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.160\(c01e160r2p8\) Vulnerable ·Huawei

Remediation

  • Fix · CNA HUAWEI Mate 20 (Huawei) Fixed in 10.1.0.160(C00E160R3P8), 10.1.0.160(C01E160R2P8)
  • Fix · CNA HUAWEI P30 (Huawei) Fixed in 10.1.0.160(C00E160R2P11)
  • Fix · CNA HUAWEI P30 Pro (Huawei) Fixed in 10.1.0.160(C00E160R2P8), 10.1.0.160(C01E160R2P8)
  • Fix · CNA Princeton-AL10D (Huawei) Fixed in 10.1.0.160(C00E160R2P11)
  • Fix · CNA Yale-AL00A (Huawei) Fixed in 10.1.0.160(C00E160R8P12)
  • Fix · CNA Yale-AL50A (Huawei) Fixed in 10.1.0.88(C00E88R8P1)
  • Fix · CNA YaleP-AL10B (Huawei) Fixed in 10.1.0.160(C00E160R8P12)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-9081
  2. 2026-10-03 Alias added: GHSA-hc6q-5pvq-h8ff

References

Advisory 1

  • TI-2020-00021 In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write… CVSS 3.1HIGH 8.8
  • TI-2019-06941 Cryptographic flaw in Bluetooth BR/EDR CVSS 3.1HIGH 8.1
  • TI-2020-07388 Buffer overflow in Huawei HONOR 20 PRO CVSS 3.1HIGH 7.8
  • TI-2019-03660 Buffer overflow in P30, Mate 20, P30 Pro CVSS 3.1HIGH 7.8
  • TI-2020-07324 Buffer overflow in HUAWEI Mate 20 CVSS 3.1HIGH 8.0
  • TI-2020-07385 HUAWEI Mate 20 versions Versions earlier than 10.1.0.160(C00E160R3P8);HUAWEI Mate 20 Pro… CVSS 3.1MEDIUM 6.8
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences