CVE-2020-9081: There is an improper authorization vulnerability in some Huawei smartphones
15
Routine
LOW 3.5MITIGATEMITIGATEMITIGATE
CVE-2020-9081 is a low-severity flaw (CVSS 3.5) affecting mate 20 firmware, p30 firmware, p30 pro firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
There is an improper authorization vulnerability in some Huawei smartphones. An attacker could perform a series of operation in specific mode to exploit this vulnerability. Successful exploit could allow the attacker to bypass app lock. (Vulnerability ID: HWPSIRT-2019-12144)
This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9081.
Why this priority
No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
huawei princeton-al10d firmware MITIGATE
Affected: < 10.1.0.160\(c00e160r2p11\)
Fixed in: 10.1.0.160\(c00e160r2p11\)
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
huawei yale-al00a firmware MITIGATE
Affected: < 10.1.0.160\(c00e160r8p12\)
Fixed in: 10.1.0.160\(c00e160r8p12\)
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
huawei yale-al50a firmware MITIGATE
Affected: < 10.1.0.88\(c00e88r8p1\)
Fixed in: 10.1.0.88\(c00e88r8p1\)
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Verify at the official sourceNVD · CVE Program · Report a problem with this page Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-9081?
mate 20 firmware: mitigate or apply the listed mitigation; p30 firmware: mitigate or apply the listed mitigation; p30 pro firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2020-9081 being exploited?
CVE-2020-9081 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-9081 affect?
CVE-2020-9081 affects mate 20 firmware, p30 firmware, p30 pro firmware. Severity is low (CVSS 3.5). There is an improper authorization vulnerability in some Huawei smartphones. An attacker could perform a series of operation in specific mode to exploit this vulnerability. Successful exploit could allow the attacker to bypass app lock. (Vu
PatchTheCVE