Strix
26.1K

CVE-2020-9247

HIGHCVSS 7.8/10EPSS 0.79%

Last modified

CVE-2020-9247 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. There is a buffer overflow vulnerability in several Huawei products. The system does not sufficiently validate certain configuration parameter which is passed from user that would cause buffer overflow. EPSS estimates a 0.79% chance of exploitation in the next 30 days.

Description

There is a buffer overflow vulnerability in several Huawei products. The system does not sufficiently validate certain configuration parameter which is passed from user that would cause buffer overflow. The attacker should trick the user into installing and running a malicious application with a high privilege, successful exploit may cause code execution. Affected product include Huawei HONOR 20 PRO, Mate 20, Mate 20 Pro, Mate 20 X, P30, P30 Pro, Hima-L29C, Laya-AL00EP, Princeton-AL10B, Tony-AL00B, Yale-L61A, Yale-TL00B and YaleP-AL10B.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability
0.79%

51.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
HuaweiHonor 20 Pro Firmware< 10.1.0.230\(c432e9r5p1\)
HuaweiMate 20 Firmware< 10.1.0.160\(c00e160r3p8\)
HuaweiMate 20 Pro Firmware< 10.1.0.270\(c432e7r1p5\)
HuaweiMate 20 X Firmware< 10.1.0.160\(c00e160r2p8\)
HuaweiP30 Firmware9.1.0.272\(c635e4r2p2\)
HuaweiP30 Pro Firmware< 10.1.0.160\(c00e160r2p8\)
HuaweiHima-L29c Firmware< 10.1.0.273\(c185e5r2p4\)
HuaweiLaya-Al00ep Firmware< 10.1.0.160\(c786e160r3p8\)
HuaweiPrinceton-Al10b Firmware< 10.1.0.160\(c00e160r2p11\)
HuaweiTony-Al00b Firmware< 10.1.0.160\(c00e160r2p11\)
HuaweiYale-L61a Firmware< 10.1.0.225\(c432e3r1p2\)
HuaweiYale-Tl00b Firmware< 10.1.0.160\(c01e160r8p12\)
HuaweiYalep-Al10b Firmware< 10.1.0.160\(c00e160r8p12\)
HuaweiHonor 20 Pro Firmware< 10.1.0.231\(c10e3r3p2\)
HuaweiMate 20 Pro Firmware< 10.1.0.270\(c635e3r1p5\)
HuaweiMate 20 Pro Firmware< 10.1.0.273\(c185e7r2p4\)
HuaweiMate 20 Pro Firmware< 10.1.0.273\(c636e7r2p4\)
HuaweiMate 20 Pro Firmware< 10.1.0.277\(c10e7r2p4\)
HuaweiMate 20 Pro Firmware< 10.1.0.277\(c605e7r1p5\)
HuaweiP30 Firmware< 10.1.0.123\(c432e22r2p5\)
HuaweiP30 Firmware< 10.1.0.126\(c10e7r5p1\)
HuaweiP30 Firmware< 10.1.0.126\(c185e4r7p1\)
HuaweiP30 Firmware< 10.1.0.126\(c605e19r1p3\)
HuaweiP30 Firmware< 10.1.0.126\(c636e5r3p4\)
HuaweiP30 Firmware< 10.1.0.126\(c636e7r3p4\)
HuaweiHima-L29c Firmware< 10.1.0.273\(c636e5r2p4\)
HuaweiHima-L29c Firmware< 10.1.0.275\(c10e4r2p4\)
HuaweiYale-L61a Firmware< 10.1.0.226\(c10e3r1p1\)

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-9247?
There is a buffer overflow vulnerability in several Huawei products. The system does not sufficiently validate certain configuration parameter which is passed from user that would cause buffer overflow. The attacker should trick the user into installing and running a malicious application with a high privilege, successful exploit may cause code execution. Affected product include Huawei HONOR 20 PRO, Mate 20, Mate 20 Pro, Mate 20 X, P30, P30 Pro, Hima-L29C, Laya-AL00EP, Princeton-AL10B, Tony-AL00B, Yale-L61A, Yale-TL00B and YaleP-AL10B.
How severe is CVE-2020-9247?
CVE-2020-9247 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.79% probability of exploitation in the next 30 days.
How do I fix CVE-2020-9247?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-9247?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST