Read the docs
TI-2020-07391 Aliases CVE-2020-9250GHSA-j9vj-qv55-qq58

Improper authentication in HUAWEI Mate 20 Pro

Priority LOW 15CWE-287Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287 and CWE-522.

Summary

There is an insufficient authentication vulnerability in some Huawei smart phone. An unauthenticated, local attacker can crafts software package to exploit this vulnerability. Due to insufficient verification, successful exploitation may impact the service. (Vulnerability ID: HWPSIRT-2019-12302) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9250.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00122 1st percentileScored 2026-11-07
Fix Fixed HUAWEI Mate 20 Pro (Huawei): 10.1.0.160(C00E160R3P8)

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HuaweiHUAWEI Mate 20 Probefore 10.1.0.160(C00E160R3P8)10.1.0.160(C00E160R3P8)Patch availableCNA
  • HUAWEI Mate 20 Pro VendorHuawei Affected before 10.1.0.160(C00E160R3P8) Fixed in 10.1.0.160(C00E160R3P8) Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:huawei:mate_20_pro_firmware:10.1.0.160\(c00e160r3p8\):*:*:*:*:*:*:*10.1.0.160(c00e160r3p8)VulnerableHuawei
cpe:2.3:h:huawei:mate_20_pro:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
  • cpe:2.3:o:huawei:mate_20_pro_firmware:10.1.0.160\(c00e160r3p8\):*:*:*:*:*:*:* Versions 10.1.0.160(c00e160r3p8) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:mate_20_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei

Remediation

  • Fix · CNA HUAWEI Mate 20 Pro (Huawei) Fixed in 10.1.0.160(C00E160R3P8)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-9250
  2. 2026-10-03 Alias added: GHSA-j9vj-qv55-qq58

References

Advisory 1

  • TI-2020-00021 In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write… CVSS 3.1HIGH 8.8
  • TI-2019-06941 Cryptographic flaw in Bluetooth BR/EDR CVSS 3.1HIGH 8.1
  • TI-2020-07388 Buffer overflow in Huawei HONOR 20 PRO CVSS 3.1HIGH 7.8
  • TI-2020-07293 Improper privilege management in HUAWEI Mate 20 Pro CVSS 3.1HIGH 7.8
  • TI-2019-03682 Improper privilege management in Mate 20 Pro CVSS 3.1HIGH 7.8
  • TI-2020-07385 HUAWEI Mate 20 versions Versions earlier than 10.1.0.160(C00E160R3P8);HUAWEI Mate 20 Pro… CVSS 3.1MEDIUM 6.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences