CVE-2020-1787

Vulnerability

An improper authentication vulnerability exists in HUAWEI Mate 20 smartphones running versions earlier than 9.1.0.139(C00E133R3P1). The system contains a logic error under certain scenarios that can be exploited to bypass screen lock authentication [1].

Exploitation

An attacker who has already gained the privilege of a guest user on the device can exploit this flaw. By triggering the logic error, the attacker can instantly switch to the host user's desktop without needing to unlock the host user's screen lock [1]. No additional user interaction or network access is required beyond guest-level access.

Impact

Successful exploitation allows the attacker to access the host user's desktop environment, potentially exposing sensitive data, applications, and settings that are normally protected by the screen lock. This represents a breach of confidentiality and a privilege escalation from guest to host user context [1].

Mitigation

Huawei has released a software update to fix this vulnerability. The resolved version is 9.1.0.139(C00E133R3P1). Users should update their devices to this version or later. No workarounds are documented [1].