Read the docs
TI-2020-07376 Aliases CVE-2020-9235GHSA-46w2-3f5r-88m4

Improper input validation in HONOR 20 PRO;Honor View…

Priority LOW 24CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Huawei smartphones HONOR 20 PRO Versions earlier than 10.1.0.230(C432E9R5P1),Versions earlier than 10.1.0.231(C10E3R3P2),Versions earlier than 10.1.0.231(C185E3R5P1),Versions earlier than 10.1.0.231(C636E3R3P1);Versions earlier than 10.1.0.212(C432E10R3P4),Versions earlier than 10.1.0.213(C636E3R4P3),Versions earlier than 10.1.0.214(C10E5R4P3),Versions earlier than 10.1.0.214(C185E3R3P3);Versions earlier than 10.1.0.212(C00E210R5P1);Versions earlier than 10.1.0.160(C00E160R2P11);Versions earlier than 10.1.0.160(C00E160R2P11);Versions earlier than 10.1.0.160(C01E160R2P11);Versions earlier than 10.1.0.160(C00E160R2P11);Versions earlier than 10.1.0.160(C00E160R8P12);Versions earlier than 10.1.0.230(C432E9R5P1),Versions earlier than 10.1.0.231(C10E3R3P2),Versions earlier than 10.1.0.231(C636E3R3P1);Versions earlier than 10.1.0.225(C431E3R1P2),Versions earlier than 10.1.0.225(C432E3R1P2) contain an information vulnerability. A module has a design error that is lack of control of input. Attackers can exploit this vulnerability to obtain some information. This can lead to information leak.

Why it matters now

EPSS 0.00242 15th percentileScored 2026-11-07
Fix Fixed HONOR 20 PRO;Honor View 20;OxfordS-AN00A;Princeton-AL10B;Princeton-AL10D;Princeton-TL10C;Tony-AL00B;Yale-AL00A;Yale-L21A;Yale-L61A: 10.1.0.212(C00E210R5P1), 10.1.0.160(C00E160R2P11), 10.1.0.160(C01E160R2P11) +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—HONOR 20 PRO;Honor View 20;OxfordS-AN00A;Princeton-AL10B;Princeton-AL10D;Princeton-TL10C;Tony-AL00B;Yale-AL00A;Yale-L21A;Yale-L61AVersions earlier than 10.1.0.230(C432E9R5P1),Versions earlier than 10.1.0.231(C10E3R3P2),Versions earlier than 10.1.0.231(C185E3R5P1),Versions earlier than 10.1.0.231(C636E3R3P1); Versions earlier than 10.1.0.212(C432E10R3P4),Versions earlier than 10.1.0.213(C636E3R4P3),Versions earlier than 10.1.0.214(C10E5R4P3),Versions earlier than 10.1.0.214(C185E3R3P3); before 10.1.0.212(C00E210R5P1); before 10.1.0.160(C00E160R2P11); before 10.1.0.160(C01E160R2P11); before 10.1.0.160(C00E160R8P12); Versions earlier than 10.1.0.230(C432E9R5P1),Versions earlier than 10.1.0.231(C10E3R3P2),Versions earlier than 10.1.0.231(C636E3R3P1); Versions earlier than 10.1.0.225(C431E3R1P2),Versions earlier than 10.1.0.225(C432E3R1P2)10.1.0.212(C00E210R5P1), 10.1.0.160(C00E160R2P11), 10.1.0.160(C01E160R2P11), 10.1.0.160(C00E160R8P12)Patch availableCNA
  • HONOR 20 PRO;Honor View 20;OxfordS-AN00A;Princeton-AL10B;Princeton-AL10D;Princeton-TL10C;Tony-AL00B;Yale-AL00A;Yale-L21A;Yale-L61A Vendor— Affected Versions earlier than 10.1.0.230(C432E9R5P1),Versions earlier than 10.1.0.231(C10E3R3P2),Versions earlier than 10.1.0.231(C185E3R5P1),Versions earlier than 10.1.0.231(C636E3R3P1); Versions earlier than 10.1.0.212(C432E10R3P4),Versions earlier than 10.1.0.213(C636E3R4P3),Versions earlier than 10.1.0.214(C10E5R4P3),Versions earlier than 10.1.0.214(C185E3R3P3); before 10.1.0.212(C00E210R5P1); before 10.1.0.160(C00E160R2P11); before 10.1.0.160(C01E160R2P11); before 10.1.0.160(C00E160R8P12); Versions earlier than 10.1.0.230(C432E9R5P1),Versions earlier than 10.1.0.231(C10E3R3P2),Versions earlier than 10.1.0.231(C636E3R3P1); Versions earlier than 10.1.0.225(C431E3R1P2),Versions earlier than 10.1.0.225(C432E3R1P2) Fixed in 10.1.0.212(C00E210R5P1), 10.1.0.160(C00E160R2P11), 10.1.0.160(C01E160R2P11), 10.1.0.160(C00E160R8P12) Patch available CNA

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:o:huawei:honor_20_pro_firmware:*:*:*:*:*:*:*:*before 10.1.0.230\(c432e9r5p1\)VulnerableHuawei
cpe:2.3:h:huawei:honor_20_pro:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:honor_20_pro_firmware:*:*:*:*:*:*:*:*before 10.1.0.231\(c10e3r3p2\); before 10.1.0.231\(c185e3r5p1\); before 10.1.0.231\(c636e3r3p1\)VulnerableHuawei
cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:*before 10.1.0.212\(c432e10r3p4\)VulnerableHuawei
cpe:2.3:h:huawei:honor_view_20:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:*before 10.1.0.213\(c636e3r4p3\); before 10.1.0.214\(c10e5r4p3\); before 10.1.0.214\(c185e3r3p3\)VulnerableHuawei
cpe:2.3:o:huawei:oxfords-an00a_firmware:*:*:*:*:*:*:*:*before 10.1.0.212\(c00e210r5p1\)VulnerableHuawei
cpe:2.3:h:huawei:oxfords-an00a:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:princeton-al10b_firmware:*:*:*:*:*:*:*:*before 10.1.0.160\(c00e160r2p11\)VulnerableHuawei
cpe:2.3:h:huawei:princeton-al10b:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
  • cpe:2.3:o:huawei:honor_20_pro_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.230\(c432e9r5p1\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:honor_20_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:honor_20_pro_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.231\(c10e3r3p2\); before 10.1.0.231\(c185e3r5p1\); before 10.1.0.231\(c636e3r3p1\) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.212\(c432e10r3p4\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:honor_view_20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.213\(c636e3r4p3\); before 10.1.0.214\(c10e5r4p3\); before 10.1.0.214\(c185e3r3p3\) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:oxfords-an00a_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.212\(c00e210r5p1\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:oxfords-an00a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:princeton-al10b_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.160\(c00e160r2p11\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:princeton-al10b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:huawei:princeton-al10d_firmware:*:*:*:*:*:*:*:*before 10.1.0.160\(c00e160r2p11\)VulnerableHuawei
cpe:2.3:h:huawei:princeton-al10d:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:princeton-tl10c_firmware:*:*:*:*:*:*:*:*before 10.1.0.160\(c01e160r2p11\)VulnerableHuawei
cpe:2.3:h:huawei:princeton-tl10c:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:tony-al00b_firmware:*:*:*:*:*:*:*:*before 10.1.0.160\(c00e160r2p11\)VulnerableHuawei
cpe:2.3:h:huawei:tony-al00b:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:yale-al00a_firmware:*:*:*:*:*:*:*:*before 10.1.0.160\(c00e160r8p12\)VulnerableHuawei
cpe:2.3:h:huawei:yale-al00a:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:yale-l21a_firmware:*:*:*:*:*:*:*:*before 10.1.0.230\(c432e9r5p1\)VulnerableHuawei
cpe:2.3:h:huawei:yale-l21a:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:yale-l21a_firmware:*:*:*:*:*:*:*:*before 10.1.0.231\(c10e3r3p2\); before 10.1.0.231\(c636e3r3p1\)VulnerableHuawei
cpe:2.3:o:huawei:yale-l61a_firmware:*:*:*:*:*:*:*:*before 10.1.0.225\(c431e3r1p2\)VulnerableHuawei
cpe:2.3:h:huawei:yale-l61a:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:yale-l61a_firmware:*:*:*:*:*:*:*:*before 10.1.0.225\(c432e3r1p2\)VulnerableHuawei
  • cpe:2.3:o:huawei:princeton-al10d_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.160\(c00e160r2p11\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:princeton-al10d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:princeton-tl10c_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.160\(c01e160r2p11\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:princeton-tl10c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:tony-al00b_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.160\(c00e160r2p11\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:tony-al00b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:yale-al00a_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.160\(c00e160r8p12\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:yale-al00a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:yale-l21a_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.230\(c432e9r5p1\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:yale-l21a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:yale-l21a_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.231\(c10e3r3p2\); before 10.1.0.231\(c636e3r3p1\) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:yale-l61a_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.225\(c431e3r1p2\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:yale-l61a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:yale-l61a_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.225\(c432e3r1p2\) Vulnerable ·Huawei

Remediation

  • Fix · CNA HONOR 20 PRO;Honor View 20;OxfordS-AN00A;Princeton-AL10B;Princeton-AL10D;Princeton-TL10C;Tony-AL00B;Yale-AL00A;Yale-L21A;Yale-L61A Fixed in 10.1.0.212(C00E210R5P1), 10.1.0.160(C00E160R2P11), 10.1.0.160(C01E160R2P11), 10.1.0.160(C00E160R8P12)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-9235
  2. 2026-10-03 Alias added: GHSA-46w2-3f5r-88m4

References

Advisory 1

  • TI-2020-00067 Out-of-bounds write in Android KEVCVSS 3.1HIGH 7.8
  • TI-2019-06941 Cryptographic flaw in Bluetooth BR/EDR CVSS 3.1HIGH 8.1
  • TI-2020-07388 Buffer overflow in Huawei HONOR 20 PRO CVSS 3.1HIGH 7.8
  • TI-2020-07368 There is a denial of service vulnerability in some Huawei smartphones. CVSS 3.1HIGH 7.5
  • TI-2020-01746 Out-of-bounds read in Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI… CVSS 3.1HIGH 7.1
  • TI-2020-07385 HUAWEI Mate 20 versions Versions earlier than 10.1.0.160(C00E160R3P8);HUAWEI Mate 20 Pro… CVSS 3.1MEDIUM 6.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences