CVE-2020-9250: huawei huawei mate 20 pro Improper Authentication
Vulnerability summary
CVE-2020-9250 is a low (CVSS 3.3) Improper Authentication vulnerability in huawei huawei mate 20 pro. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 1.7% of scored vulnerabilities.
Timeline
- 20-12-2024PublishedVulnerability first disclosed.
- 20-12-2024Last modifiedVulnerability information updated.
Description
There is an insufficient authentication vulnerability in some Huawei smart phone. An unauthenticated, local attacker can crafts software package to exploit this vulnerability. Due to insufficient verification, successful exploitation may impact the service. (Vulnerability ID: HWPSIRT-2019-12302) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9250.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST3.3LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.12%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
0.00 pp
From 0.12% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Affected systems
Huawei2 products
- huawei mate 20 proVersions earlier than 10.1.0.160(C00E160R3P8)
- mate_20_pro_firmware10.1.0.160\(c00e160r3p8\)
1 vendor · 2 products
References
1 links- www.huawei.com/en/psirt/security-advisories/huawei-sa-20200729-01-smartphone-enBroken LinkVendor Advisory