Read the docs
TI-2020-07362 Aliases CVE-2020-9209GHSA-wqm8-5876-3578

Missing authorization in SMC2.0

Priority LOW 29CWE-862Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

There is a privilege escalation vulnerability in SMC2.0 product. Some files in a directory of a module are located improperly. It does not apply the directory limitation. Attackers can exploit this vulnerability by crafting malicious file to launch privilege escalation. This can compromise normal service of affected products.

Why it matters now

EPSS 0.00215 11th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—SMC2.0V600R006C00SPC700,V600R006C00SPC800,V600R006C10SPC500,V600R006C10SPC600,V600R006C10SPC601,V600R006C10SPC602,V600R006C10SPC700,V600R006C10SPC800,V600R006C10SPCa00,V600R006C10SPCb00,V600R006C10SPCc00,V600R006C10SPCd00,V600R006C10SPCe00,V600R019C00,V600R019C10—No fix listedCNA
  • SMC2.0 Vendor— Affected V600R006C00SPC700,V600R006C00SPC800,V600R006C10SPC500,V600R006C10SPC600,V600R006C10SPC601,V600R006C10SPC602,V600R006C10SPC700,V600R006C10SPC800,V600R006C10SPCa00,V600R006C10SPCb00,V600R006C10SPCc00,V600R006C10SPCd00,V600R006C10SPCe00,V600R019C00,V600R019C10 Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:o:huawei:smc2.0_firmware:v600r006c00spc700:*:*:*:*:*:*:*v600r006c00spc700VulnerableHuawei
cpe:2.3:o:huawei:smc2.0_firmware:v600r006c00spc800:*:*:*:*:*:*:*v600r006c00spc800VulnerableHuawei
cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spc500:*:*:*:*:*:*:*v600r006c10spc500VulnerableHuawei
cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spc600:*:*:*:*:*:*:*v600r006c10spc600VulnerableHuawei
cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spc601:*:*:*:*:*:*:*v600r006c10spc601VulnerableHuawei
cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spc602:*:*:*:*:*:*:*v600r006c10spc602VulnerableHuawei
cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spc700:*:*:*:*:*:*:*v600r006c10spc700VulnerableHuawei
cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spc800:*:*:*:*:*:*:*v600r006c10spc800VulnerableHuawei
cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spca00:*:*:*:*:*:*:*v600r006c10spca00VulnerableHuawei
cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spcb00:*:*:*:*:*:*:*v600r006c10spcb00VulnerableHuawei
  • cpe:2.3:o:huawei:smc2.0_firmware:v600r006c00spc700:*:*:*:*:*:*:* Versions v600r006c00spc700 Vulnerable ·Huawei
  • cpe:2.3:o:huawei:smc2.0_firmware:v600r006c00spc800:*:*:*:*:*:*:* Versions v600r006c00spc800 Vulnerable ·Huawei
  • cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spc500:*:*:*:*:*:*:* Versions v600r006c10spc500 Vulnerable ·Huawei
  • cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spc600:*:*:*:*:*:*:* Versions v600r006c10spc600 Vulnerable ·Huawei
  • cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spc601:*:*:*:*:*:*:* Versions v600r006c10spc601 Vulnerable ·Huawei
  • cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spc602:*:*:*:*:*:*:* Versions v600r006c10spc602 Vulnerable ·Huawei
  • cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spc700:*:*:*:*:*:*:* Versions v600r006c10spc700 Vulnerable ·Huawei
  • cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spc800:*:*:*:*:*:*:* Versions v600r006c10spc800 Vulnerable ·Huawei
  • cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spca00:*:*:*:*:*:*:* Versions v600r006c10spca00 Vulnerable ·Huawei
  • cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spcb00:*:*:*:*:*:*:* Versions v600r006c10spcb00 Vulnerable ·Huawei
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spcc00:*:*:*:*:*:*:*v600r006c10spcc00VulnerableHuawei
cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spcd00:*:*:*:*:*:*:*v600r006c10spcd00VulnerableHuawei
cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spce00:*:*:*:*:*:*:*v600r006c10spce00VulnerableHuawei
cpe:2.3:o:huawei:smc2.0_firmware:v600r019c00:*:*:*:*:*:*:*v600r019c00VulnerableHuawei
cpe:2.3:o:huawei:smc2.0_firmware:v600r019c10:*:*:*:*:*:*:*v600r019c10VulnerableHuawei
cpe:2.3:h:huawei:smc2.0:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
  • cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spcc00:*:*:*:*:*:*:* Versions v600r006c10spcc00 Vulnerable ·Huawei
  • cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spcd00:*:*:*:*:*:*:* Versions v600r006c10spcd00 Vulnerable ·Huawei
  • cpe:2.3:o:huawei:smc2.0_firmware:v600r006c10spce00:*:*:*:*:*:*:* Versions v600r006c10spce00 Vulnerable ·Huawei
  • cpe:2.3:o:huawei:smc2.0_firmware:v600r019c00:*:*:*:*:*:*:* Versions v600r019c00 Vulnerable ·Huawei
  • cpe:2.3:o:huawei:smc2.0_firmware:v600r019c10:*:*:*:*:*:*:* Versions v600r019c10 Vulnerable ·Huawei
  • cpe:2.3:h:huawei:smc2.0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-9209
  2. 2026-10-03 Alias added: GHSA-wqm8-5876-3578

References

Advisory 1

  • TI-2019-00485 Use after free in Microsoft Windows KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-12675 Improper certificate validation in Huawei… CVSS 3.0CRITICAL 9.8
  • TI-2019-14007 Memory corruption in Huawei AR120-S CVSS 3.1HIGH 7.5
  • TI-2019-14006 Memory corruption in Huawei AR120-S CVSS 3.1HIGH 7.5
  • TI-2019-14005 Memory corruption in Huawei AR120-S CVSS 3.1HIGH 7.5
  • TI-2021-05274 There is a local privilege escalation vulnerability in some Huawei products. CVSS 3.1HIGH 7.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences