CVE-2020-9109
Description
There is an information disclosure vulnerability in several smartphones. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario, the attacker need to gain certain information in the victim's smartphone to launch the attack, and successful exploit could cause information disclosure.Affected product versions include:HUAWEI Mate 20 versions earlier than 10.1.0.160(C00E160R3P8),versions earlier than 10.1.0.160(C01E160R2P8);HUAWEI Mate 20 X versions earlier than 10.1.0.160(C00E160R2P8),versions earlier than 10.1.0.160(C01E160R2P8);HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8);Laya-AL00EP versions earlier than 10.1.0.160(C786E160R3P8);Tony-AL00B versions earlier than 10.1.0.160(C00E160R2P11);Tony-TL00B versions earlier than 10.1.0.160(C01E160R2P11).
How to fix
- huawei mate_20_firmware10.1.0.160\(c00e160r3p8\), 10.1.0.160\(c01e160r2p8\) or later
- huawei mate_20_x_firmware10.1.0.160\(c00e160r2p8\), 10.1.0.160\(c01e160r2p8\) or later
- huawei p30_pro_firmware10.1.0.160\(c00e160r2p8\) or later
- huawei laya-al00ep_firmware10.1.0.160\(c786e160r3p8\) or later
- huawei tony-al00b_firmware10.1.0.160\(c00e160r2p11\) or later
- huawei tony-tl00b_firmware10.1.0.160\(c01e160r2p11\) or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| huawei mate_20_firmware | v < 10.1.0.160\(c00e160r3p8\), v < 10.1.0.160\(c01e160r2p8\) | 10.1.0.160\(c00e160r3p8\), 10.1.0.160\(c01e160r2p8\) |
| huawei mate_20_x_firmware | v < 10.1.0.160\(c00e160r2p8\), v < 10.1.0.160\(c01e160r2p8\) | 10.1.0.160\(c00e160r2p8\), 10.1.0.160\(c01e160r2p8\) |
| huawei p30_pro_firmware | v < 10.1.0.160\(c00e160r2p8\) | 10.1.0.160\(c00e160r2p8\) |
| huawei laya-al00ep_firmware | v < 10.1.0.160\(c786e160r3p8\) | 10.1.0.160\(c786e160r3p8\) |
| huawei tony-al00b_firmware | v < 10.1.0.160\(c00e160r2p11\) | 10.1.0.160\(c00e160r2p11\) |
| huawei tony-tl00b_firmware | v < 10.1.0.160\(c01e160r2p11\) | 10.1.0.160\(c01e160r2p11\) |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.