Read the docs
TI-2020-07358 Aliases CVE-2020-9205GHSA-c52j-mfvx-x96x

CSV injection in ManageOne

Priority LOW 23CWE-1236Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

There has a CSV injection vulnerability in ManageOne 8.0.1. An attacker with common privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject CSV files to the target device.

Why it matters now

EPSS 0.00632 50th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—ManageOne8.0.1—No fix listedCNA
  • ManageOne Vendor— Affected 8.0.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:huawei:manageone:8.0.1:*:*:*:*:*:*:*8.0.1VulnerableHuawei
  • cpe:2.3:a:huawei:manageone:8.0.1:*:*:*:*:*:*:* Versions 8.0.1 Vulnerable ·Huawei

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-9205
  2. 2026-10-03 Alias added: GHSA-c52j-mfvx-x96x
  3. 2026-11-01 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2021-05269 Some Huawei products have an inconsistent interpretation of HTTP requests vulnerability. CVSS 3.1HIGH 7.5
  • TI-2019-11040 Buffer overflow in Linux kernel CVSS 3.1HIGH 7.8
  • TI-2021-05274 There is a local privilege escalation vulnerability in some Huawei products. CVSS 3.1HIGH 7.8
  • TI-2020-07326 Improper input validation in ManageOne CVSS 3.1HIGH 7.2
  • TI-2019-03718 Out-of-bounds read in ManageOne CVSS 3.1HIGH 7.5
  • TI-2021-05289 There is a local privilege escalation vulnerability in some versions of ManageOne. CVSS 3.1HIGH 7.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences