CVE-2020-1786

Vulnerability

The software in HUAWEI Mate 20 Pro smartphones versions earlier than 10.0.0.175(C00E69R3P8) does not sufficiently validate the name of an APK file under a special condition. This improper authentication vulnerability (HWPSIRT-2019-07118) allows an attacker to forge a crafted application as a legitimate one [1].

Exploitation

An attacker can craft a malicious APK file with a specially crafted name that bypasses the insufficient validation. The attacker then needs to have the application installed on the target device, likely requiring user interaction to install the forged application. The exact attack vector is not detailed in the available references [1].

Impact

Successful exploitation allows the attacker to bypass the digital balance function of the device. This function is a security feature that controls digital spending or access to paid content. The attacker gains the ability to circumvent this restriction, potentially enabling unauthorized transactions or access [1].

Mitigation

Huawei has released software updates to fix this vulnerability. The resolved version is 10.0.0.175(C00E69R3P8). Users are advised to update their devices to this version or later. No workarounds are provided in the advisory [1].