CVE-2020-1794

Vulnerability

An improper authentication vulnerability exists in the applock feature of several Huawei smartphones. The applock does not perform sufficient authentication in certain scenarios, allowing an attacker to bypass the lock and access data from the locked application. Affected products include HUAWEI Mate 20 versions earlier than 10.0.0.188(C00E74R3P8) and HUAWEI Mate 30 Pro versions earlier than 10.0.0.203(C00E202R7P2) [1].

Exploitation

The exact exploitation scenario is not fully disclosed in the available references, but the vulnerability is triggered when the applock fails to properly authenticate the user. An attacker with physical access to the device or the ability to interact with the locked application could potentially exploit this flaw. No specific sequence of steps has been published [1].

Impact

Successful exploitation allows the attacker to gain access to certain data from the application that is locked by applock. This constitutes a breach of confidentiality, as the attacker can retrieve sensitive information that the user intended to protect [1].

Mitigation

Huawei has released software updates to fix these vulnerabilities. For HUAWEI Mate 20, the fix is included in version 10.0.0.188(C00E74R3P8) and later. For HUAWEI Mate 30 Pro, the fix is included in version 10.0.0.203(C00E202R7P2) and later. Users should update their devices to the latest available firmware. No workarounds have been provided [1].