CVE-2020-9250

Vulnerability

An insufficient authentication vulnerability exists in some Huawei smartphones, specifically the HUAWEI Mate 20 Pro running versions earlier than 10.1.0.160(C00E160R3P8). The vulnerability arises from insufficient verification of software packages, allowing an unauthenticated local attacker to craft a malicious package that can impact the device's service. [1]

Exploitation

An unauthenticated local attacker can exploit this vulnerability by crafting a software package. The exact exploitation steps are not detailed in the advisory, but the attack requires local access and the ability to deliver the crafted package to the device. The insufficient verification process fails to properly validate the package, leading to the impact. [1]

Impact

Successful exploitation of this vulnerability may impact the service on the affected device. The advisory does not specify the exact nature of the impact, but it could involve denial of service or other service degradation. No further details on confidentiality, integrity, or availability are provided. [1]

Mitigation

Huawei has released a software update to fix this vulnerability. The resolved version for HUAWEI Mate 20 Pro is 10.1.0.160(C00E160R3P8), released on 2020-07-29. Users are advised to update to this version or later. No workarounds are documented in the available references. [1]