CVE-2020-1882

Severity: medium (CVSS 4.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-02-18 · updated 2026-06-17

Description

Huawei mobile phones Ever-L29B versions earlier than 10.0.0.180(C185E6R3P3), earlier than 10.0.0.180(C432E6R1P7), earlier than 10.0.0.180(C636E5R2P3); HUAWEI Mate 20 RS versions earlier than 10.0.0.175(C786E70R3P8); HUAWEI Mate 20 X versions earlier than 10.0.0.176(C00E70R2P8); and Honor Magic2 versions earlier than 10.0.0.175(C00E59R2P11) have an improper authorization vulnerability. Due to improper authorization of some function, attackers can bypass the authorization to perform some operations.

Affected products

Huawei Ever-L29B Firmware: before 10.0.0.180\(c185e6r3p3\); before 10.0.0.180\(c432e6r1p7\); before 10.0.0.180\(c636e5r2p3\) — fixed in 10.0.0.180\(c185e6r3p3\), 10.0.0.180\(c432e6r1p7\), 10.0.0.180\(c636e5r2p3\)
Huawei Honor Magic2: before 10.0.0.175\(c00e59r2p11\) — fixed in 10.0.0.175\(c00e59r2p11\)
Mate 20 RS: before 10.0.0.175\(c786e70r3p8\) — fixed in 10.0.0.175\(c786e70r3p8\)
Huawei Mate 20 X: before 10.0.0.176\(c00e70r2p8\) — fixed in 10.0.0.176\(c00e70r2p8\)

How to fix

Upgrade to a fixed version: Huawei Ever-L29B Firmware 10.0.0.180\(c185e6r3p3\), 10.0.0.180\(c432e6r1p7\), 10.0.0.180\(c636e5r2p3\); Huawei Honor Magic2 10.0.0.175\(c00e59r2p11\); Mate 20 RS 10.0.0.175\(c786e70r3p8\); Huawei Mate 20 X 10.0.0.176\(c00e70r2p8\). Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-1882 or the next vulnerability affects your stack