CVE-2020-9092

Vulnerability

A JavaScript injection vulnerability exists in Huawei Mate 20 smartphones running versions earlier than 10.1.0.163(C00E160R3P8). A specific module does not properly verify a particular input, allowing an attacker to bypass the filter mechanism and inject arbitrary JavaScript code [1].

Exploitation

To exploit this vulnerability, an attacker must have physical access to the affected device. With physical access, the attacker can craft a malicious input that bypasses the module's filter, leading to JavaScript injection [1]. The exact sequence of steps is not detailed in the available references.

Impact

Successful exploitation compromises the normal service of the affected module. The injected JavaScript can alter the behavior of the module, potentially leading to information disclosure or disruption of functionality [1]. The full scope of impact is limited to the affected module.

Mitigation

Huawei has released a fix in version 10.1.0.163(C00E160R3P8) for the HUAWEI Mate 20. Users should update their devices to this version or later to remediate the vulnerability [1]. No workarounds are documented.