Read the docs
TI-2020-07380 Aliases CVE-2020-9239GHSA-f8jg-xpjx-j54w

Improper input validation in BLA-A09;BLA-TL00B;Berkeley-L09;Duke-L09;HUAWEI P20;HUAWEI…

Priority LOW 24CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Huawei smartphones BLA-A09 versions 8.0.0.123(C212),versions earlier than 8.0.0.123(C567),versions earlier than 8.0.0.123(C797);BLA-TL00B versions earlier than 8.1.0.326(C01);Berkeley-L09 versions earlier than 8.0.0.163(C10),versions earlier than 8.0.0.163(C432),Versions earlier than 8.0.0.163(C636),Versions earlier than 8.0.0.172(C10);Duke-L09 versions Duke-L09C10B187, versions Duke-L09C432B189, versions Duke-L09C636B189;HUAWEI P20 versions earlier than 8.0.1.16(C00);HUAWEI P20 Pro versions earlier than 8.1.0.152(C00);Jimmy-AL00A versions earlier than Jimmy-AL00AC00B172;LON-L29D versions LON-L29DC721B192;NEO-AL00D versions earlier than 8.1.0.172(C786);Stanford-AL00 versions Stanford-AL00C00B123;Toronto-AL00 versions earlier than Toronto-AL00AC00B225;Toronto-AL00A versions earlier than Toronto-AL00AC00B225;Toronto-TL10 versions earlier than Toronto-TL10C01B225 have an information vulnerability. A module has a design error that is lack of control of input. Attackers can exploit this vulnerab

Why it matters now

EPSS 0.00242 15th percentileScored 2026-11-07
Fix Fixed BLA-A09;BLA-TL00B;Berkeley-L09;Duke-L09;HUAWEI P20;HUAWEI P20 Pro;Jimmy-AL00A;LON-L29D;NEO-AL00D;Stanford-AL00;Toronto-AL00;Toronto-AL00A;Toronto-TL10: 8.1.0.326(C01), 8.0.1.16(C00), 8.1.0.152(C00) +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—BLA-A09;BLA-TL00B;Berkeley-L09;Duke-L09;HUAWEI P20;HUAWEI P20 Pro;Jimmy-AL00A;LON-L29D;NEO-AL00D;Stanford-AL00;Toronto-AL00;Toronto-AL00A;Toronto-TL108.0.0.123(C212),Versions earlier than 8.0.0.123(C567),Versions earlier than 8.0.0.123(C797); before 8.1.0.326(C01); Versions earlier than 8.0.0.163(C10),Versions earlier than 8.0.0.163(C432),Versions earlier than 8.0.0.163(C636),Versions earlier than 8.0.0.172(C10); Duke-L09C10B187,Duke-L09C432B189,Duke-L09C636B189; before 8.0.1.16(C00); before 8.1.0.152(C00); Versions earlier than Jimmy-AL00AC00B172; LON-L29DC721B192; before 8.1.0.172(C786); Stanford-AL00C00B123; Versions earlier than Toronto-AL00AC00B225; Versions earlier than Toronto-TL10C01B2258.1.0.326(C01), 8.0.1.16(C00), 8.1.0.152(C00), 8.1.0.172(C786)Patch availableCNA
  • BLA-A09;BLA-TL00B;Berkeley-L09;Duke-L09;HUAWEI P20;HUAWEI P20 Pro;Jimmy-AL00A;LON-L29D;NEO-AL00D;Stanford-AL00;Toronto-AL00;Toronto-AL00A;Toronto-TL10 Vendor— Affected 8.0.0.123(C212),Versions earlier than 8.0.0.123(C567),Versions earlier than 8.0.0.123(C797); before 8.1.0.326(C01); Versions earlier than 8.0.0.163(C10),Versions earlier than 8.0.0.163(C432),Versions earlier than 8.0.0.163(C636),Versions earlier than 8.0.0.172(C10); Duke-L09C10B187,Duke-L09C432B189,Duke-L09C636B189; before 8.0.1.16(C00); before 8.1.0.152(C00); Versions earlier than Jimmy-AL00AC00B172; LON-L29DC721B192; before 8.1.0.172(C786); Stanford-AL00C00B123; Versions earlier than Toronto-AL00AC00B225; Versions earlier than Toronto-TL10C01B225 Fixed in 8.1.0.326(C01), 8.0.1.16(C00), 8.1.0.152(C00), 8.1.0.172(C786) Patch available CNA

CPE configurations NVD · 30

CPEVersionsRoleVendor
cpe:2.3:o:huawei:bla-a09_firmware:8.0.0.123\(c212\):*:*:*:*:*:*:*8.0.0.123(c212)VulnerableHuawei
cpe:2.3:h:huawei:bla-a09:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:bla-a09_firmware:*:*:*:*:*:*:*:*before 8.0.0.123\(c567\); before 8.0.0.123\(c797\)VulnerableHuawei
cpe:2.3:o:huawei:bla-tl00b_firmware:*:*:*:*:*:*:*:*before 8.1.0.326\(c01\)VulnerableHuawei
cpe:2.3:h:huawei:bla-tl00b:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:berkeley-l09_firmware:*:*:*:*:*:*:*:*before 8.0.0.163\(c10\)VulnerableHuawei
cpe:2.3:h:huawei:berkeley-l09:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:berkeley-l09_firmware:*:*:*:*:*:*:*:*up to 8.0.0.163\(c432\); before 8.0.0.163\(c636\); before 8.0.0.172\(c10\)VulnerableHuawei
cpe:2.3:o:huawei:duke-l09_firmware:duke-l09c10b187:*:*:*:*:*:*:*duke-l09c10b187VulnerableHuawei
cpe:2.3:o:huawei:duke-l09_firmware:duke-l09c432b189:*:*:*:*:*:*:*duke-l09c432b189VulnerableHuawei
  • cpe:2.3:o:huawei:bla-a09_firmware:8.0.0.123\(c212\):*:*:*:*:*:*:* Versions 8.0.0.123(c212) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:bla-a09:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:bla-a09_firmware:*:*:*:*:*:*:*:* Versions before 8.0.0.123\(c567\); before 8.0.0.123\(c797\) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:bla-tl00b_firmware:*:*:*:*:*:*:*:* Versions before 8.1.0.326\(c01\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:bla-tl00b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:berkeley-l09_firmware:*:*:*:*:*:*:*:* Versions before 8.0.0.163\(c10\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:berkeley-l09:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:berkeley-l09_firmware:*:*:*:*:*:*:*:* Versions up to 8.0.0.163\(c432\); before 8.0.0.163\(c636\); before 8.0.0.172\(c10\) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:duke-l09_firmware:duke-l09c10b187:*:*:*:*:*:*:* Versions duke-l09c10b187 Vulnerable ·Huawei
  • cpe:2.3:o:huawei:duke-l09_firmware:duke-l09c432b189:*:*:*:*:*:*:* Versions duke-l09c432b189 Vulnerable ·Huawei
Show 20 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:huawei:duke-l09_firmware:duke-l09c636b189:*:*:*:*:*:*:*duke-l09c636b189VulnerableHuawei
cpe:2.3:h:huawei:duke-l09:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:p20_firmware:*:*:*:*:*:*:*:*before 8.0.1.16\(c00\)VulnerableHuawei
cpe:2.3:h:huawei:p20:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:p20_pro_firmware:*:*:*:*:*:*:*:*before 8.1.0.152\(c00\)VulnerableHuawei
cpe:2.3:h:huawei:p20_pro:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:jimmy-al00a_firmware:*:*:*:*:*:*:*:*before jimmy-al00ac00b172VulnerableHuawei
cpe:2.3:h:huawei:jimmy-al00a:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:lon-l29d_firmware:lon-l29dc721b192:*:*:*:*:*:*:*lon-l29dc721b192VulnerableHuawei
cpe:2.3:h:huawei:lon-l29d:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:neo-al00d_firmware:*:*:*:*:*:*:*:*before 8.1.0.172\(c786\)VulnerableHuawei
cpe:2.3:h:huawei:neo-al00d:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:stanford-al00_firmware:stanford-al00c00b123:*:*:*:*:*:*:*stanford-al00c00b123VulnerableHuawei
cpe:2.3:h:huawei:stanford-al00:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:toronto-al00_firmware:*:*:*:*:*:*:*:*before toronto-al00ac00b225VulnerableHuawei
cpe:2.3:h:huawei:toronto-al00:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:toronto-al00a_firmware:*:*:*:*:*:*:*:*before toronto-al00ac00b225VulnerableHuawei
cpe:2.3:h:huawei:toronto-al00a:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:toronto-tl10_firmware:*:*:*:*:*:*:*:*before toronto-tl10c01b225VulnerableHuawei
cpe:2.3:h:huawei:toronto-tl10:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
  • cpe:2.3:o:huawei:duke-l09_firmware:duke-l09c636b189:*:*:*:*:*:*:* Versions duke-l09c636b189 Vulnerable ·Huawei
  • cpe:2.3:h:huawei:duke-l09:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:p20_firmware:*:*:*:*:*:*:*:* Versions before 8.0.1.16\(c00\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:p20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:p20_pro_firmware:*:*:*:*:*:*:*:* Versions before 8.1.0.152\(c00\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:p20_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:jimmy-al00a_firmware:*:*:*:*:*:*:*:* Versions before jimmy-al00ac00b172 Vulnerable ·Huawei
  • cpe:2.3:h:huawei:jimmy-al00a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:lon-l29d_firmware:lon-l29dc721b192:*:*:*:*:*:*:* Versions lon-l29dc721b192 Vulnerable ·Huawei
  • cpe:2.3:h:huawei:lon-l29d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:neo-al00d_firmware:*:*:*:*:*:*:*:* Versions before 8.1.0.172\(c786\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:neo-al00d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:stanford-al00_firmware:stanford-al00c00b123:*:*:*:*:*:*:* Versions stanford-al00c00b123 Vulnerable ·Huawei
  • cpe:2.3:h:huawei:stanford-al00:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:toronto-al00_firmware:*:*:*:*:*:*:*:* Versions before toronto-al00ac00b225 Vulnerable ·Huawei
  • cpe:2.3:h:huawei:toronto-al00:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:toronto-al00a_firmware:*:*:*:*:*:*:*:* Versions before toronto-al00ac00b225 Vulnerable ·Huawei
  • cpe:2.3:h:huawei:toronto-al00a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:toronto-tl10_firmware:*:*:*:*:*:*:*:* Versions before toronto-tl10c01b225 Vulnerable ·Huawei
  • cpe:2.3:h:huawei:toronto-tl10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei

Remediation

  • Fix · CNA BLA-A09;BLA-TL00B;Berkeley-L09;Duke-L09;HUAWEI P20;HUAWEI P20 Pro;Jimmy-AL00A;LON-L29D;NEO-AL00D;Stanford-AL00;Toronto-AL00;Toronto-AL00A;Toronto-TL10 Fixed in 8.1.0.326(C01), 8.0.1.16(C00), 8.1.0.152(C00), 8.1.0.172(C786)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-9239
  2. 2026-10-03 Alias added: GHSA-f8jg-xpjx-j54w

References

Advisory 1

  • TI-2020-00067 Out-of-bounds write in Android KEVCVSS 3.1HIGH 7.8
  • TI-2019-01829 Use after free in Android KEVCVSS 3.1HIGH 7.8
  • TI-2019-06941 Cryptographic flaw in Bluetooth BR/EDR CVSS 3.1HIGH 8.1
  • TI-2020-07282 There is an information leakage vulnerability in some Huawei products. CVSS 3.1MEDIUM 6.5
  • TI-2019-03732 Improper input validation in Huawei ALP-AL00B CVSS 3.1MEDIUM 5.3
  • TI-2019-03731 Improper input validation in Huawei Sydney-L21 CVSS 3.1MEDIUM 5.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences