Lucene search

HuaweiCVE-2020-9076

HistoryJun 15, 2020 - 4:15 p.m.

CVE-2020-9076

2020-06-1516:15:23

CWE-287

huawei

web.nvd.nist.gov

cve-2020-9076

huawei

p30

p30 pro

improper authentication

vulnerability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:P/A:N

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

47.9%

JSON

HUAWEI P30;HUAWEI P30 Pro;Tony-AL00B smartphones with versions earlier than 10.1.0.135(C00E135R2P11); versions earlier than 10.1.0.135(C00E135R2P8), versions earlier than 10.1.0.135 have an improper authentication vulnerability. Due to the identity of the message sender not being properly verified, an attacker can exploit this vulnerability through man-in-the-middle attack to induce user to access malicious URL.

Affected configurations

Nvd

Vulners

Node

huaweip30Match-

AND

huaweip30_firmwareRange<10.1.0.135\(c00e135r2p11\)

Node

huaweip30_proMatch-

AND

huaweip30_pro_firmwareRange<10.1.0.135\(c00e135r2p8\)

Node

huaweip30_proMatch-

AND

huaweip30_pro_firmwareRange<10.1.0.135\(c01e135r2p8\)

Node

huaweitony-al00bMatch-

AND

huaweitony-al00b_firmwareRange<10.1.0.137\(c00e137r2p11\)

VendorProductVersionCPE
huaweip30-cpe:2.3:h:huawei:p30:-:*:*:*:*:*:*:*
huaweip30_firmware*cpe:2.3:o:huawei:p30_firmware:*:*:*:*:*:*:*:*
huaweip30_pro-cpe:2.3:h:huawei:p30_pro:-:*:*:*:*:*:*:*
huaweip30_pro_firmware*cpe:2.3:o:huawei:p30_pro_firmware:*:*:*:*:*:*:*:*
huaweitony-al00b-cpe:2.3:h:huawei:tony-al00b:-:*:*:*:*:*:*:*
huaweitony-al00b_firmware*cpe:2.3:o:huawei:tony-al00b_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	p30	-	cpe:2.3:h:huawei:p30:-:::::::*
huawei	p30_firmware	*	cpe:2.3:o:huawei:p30_firmware::::::::
huawei	p30_pro	-	cpe:2.3:h:huawei:p30_pro:-:::::::*
huawei	p30_pro_firmware	*	cpe:2.3:o:huawei:p30_pro_firmware::::::::
huawei	tony-al00b	-	cpe:2.3:h:huawei:tony-al00b:-:::::::*
huawei	tony-al00b_firmware	*	cpe:2.3:o:huawei:tony-al00b_firmware::::::::

CNA Affected

[
  {
    "product": "HUAWEI P30;HUAWEI P30 Pro;Tony-AL00B",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Versions earlier than 10.1.0.135(C00E135R2P11)"
      },
      {
        "status": "affected",
        "version": "Versions earlier than 10.1.0.135(C00E135R2P8),Versions earlier than 10.1.0.135(C01E135R2P8)"
      },
      {
        "status": "affected",
        "version": "Versions earlier than 10.1.0.137(C00E137R2P11)"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20200610-02-phone-en

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:P/A:N

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

47.9%

JSON

Related for CVE-2020-9076