CVE-2020-9076

Vulnerability

CVE-2020-9076 is an improper authentication vulnerability in Huawei P30, P30 Pro, and Tony-AL00B smartphones running versions earlier than 10.1.0.135(C00E135R2P11) for P30, earlier than 10.1.0.135(C00E135R2P8) for P30 Pro, and earlier than 10.1.0.135(C01E135R2P8) for Tony-AL00B [1]. The issue lies in the message sender identity verification mechanism; when receiving certain types of messages, the device fails to properly authenticate the sender, allowing an attacker to inject malicious content [1].

Exploitation

An attacker must be in a network position to perform a man-in-the-middle (MITM) attack on the victim's device communication [1]. No authentication or prior access to the device is required. The attacker can then intercept or inject messages that appear to come from a trusted source, and induce the user to click on a malicious URL [1]. The attack requires user interaction (the user clicking the URL) but does not require the attacker to have any special privileges on the device.

Impact

Successful exploitation allows the attacker to lead the user to a malicious website, which could then be used for further attacks such as phishing, malware installation, or credential theft [1]. The impact is primarily on the confidentiality and integrity of user data, depending on the nature of the malicious URL. The attacker does not gain direct remote code execution or access to the device, but the user's trust is abused to achieve the compromise [1].

Mitigation

Huawei released fixed versions: 10.1.0.135(C00E135R2P11) for P30, 10.1.0.135(C00E135R2P8) for P30 Pro, and 10.1.0.135(C01E135R2P8) for Tony-AL00B [1]. Users should update their devices to these versions or later via the device's update mechanism. No workaround is documented. There is no indication that this CVE is listed in the CISA Known Exploited Vulnerabilities catalog.