CVE-2020-9252: HUAWEI Mate 20 versions earlier than 10.1.0.160(C00E160R3P8), HUAWEI Mate 20 X versions earlier than 10.1.0.135(C00E135R2P8), HUAWEI Mate 20 RS versions…

PriorityP410low2.3CVSS 3.1

AVLACLPRHUINSUCNILAN

EPSS

0.23%

13.2th percentile

HUAWEI Mate 20 versions earlier than 10.1.0.160(C00E160R3P8), HUAWEI Mate 20 X versions earlier than 10.1.0.135(C00E135R2P8), HUAWEI Mate 20 RS versions earlier than 10.1.0.160(C786E160R3P8), and Honor Magic2 smartphones versions earlier than 10.1.0.160(C00E160R2P11) have a path traversal vulnerability. The system does not sufficiently validate certain pathname from certain process, successful exploit could allow the attacker write files to a crafted path.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
huawei	magic2_firmware	< 10.1.0.160\(c00e160r2p11\)	10.1.0.160\(c00e160r2p11\)
huawei	mate_20_firmware	< 10.1.0.160\(c00e160r3p8\)	10.1.0.160\(c00e160r3p8\)
huawei	mate_20_rs_firmware	< 10.1.0.160\(c786e160r3p8\)	10.1.0.160\(c786e160r3p8\)
huawei	mate_20_x_firmware	< 10.1.0.135\(c00e135r2p8\)	10.1.0.135\(c00e135r2p8\)

CVSS provenance

nvdv3.12.3LOWCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.