CVE-2020-9069

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-21 · updated 2026-06-17

Description

There is an information leakage vulnerability in some Huawei products. An unauthenticated, adjacent attacker could exploit this vulnerability to decrypt data. Successful exploitation may leak information randomly. Affected product versions include: Anne-AL00 Versions earlier than 9.1.0.331(C675E9R1P3T8); Berkeley-L09 Versions earlier than 10.0.1.1(C675R1); CD16-10 Versions earlier than 10.0.2.8; CD17-10 Versions earlier than 10.0.2.8; CD17-16 Versions earlier than 10.0.2.8; CD18-10 Versions earlier than 10.0.2.8; CD18-16 Versions earlier than 10.0.2.8; Columbia-TL00B Versions earlier than 9.0.0.187(C01E181R1P20T8); E6878-370 Versions earlier than 10.0.5.1(H610SP10C00); HUAWEI P30 lite Versions earlier than 10.0.0.185(C605E3R1P3), Versions earlier than 10.0.0.197(C432E8R2P7); HUAWEI nova 4e Versions earlier than 10.0.0.158(C00E64R1P9); Honor 10 Lite 9.0.1.113(C675E11R1P12); LelandP-L22A Versions earlier than 9.1.0.166(C675E5R1P4T8); Marie-AL00AX Versions earlier than 10.0.0.158(C00E64R1P9); Marie-AL00AY Versions earlier than 10.0.0.158(C00E64R1P9); Marie-AL00BX Versions earlier than 10.0.0.158(C00E64R1P9); Marie-L03BX Versions earlier than 10.0.0.188(C605E5R1P1); Marie-L21BX Versions earlier than 10.0.0.188(C432E4R4P1), Versions earlier than 10.0.0.188(C461E5R3P1); Marie-L22BX Versions earlier than 10.0.0.188(C636E3R3P1); Marie-L23BX Versions earlier than 10.0.0.188(C605E5R1P1); TC5200-16 Versions earlier than 10.0.2.8; WS5200-11 Versions earlier than 10.0.2.8; WS5200-12 Versions earlier than 10.0.2.23; WS5200-16 Versions earlier than 10.0.2.8; WS5200-17 Versions earlier than 10.0.2.23; WS5800-10 Versions earlier than 10.0.3.27; WS6500-10 Versions earlier than 10.0.2.8; WS6500-16 Versions earlier than 10.0.2.8

Affected products

Huawei Technologies Co., Ltd. Anne-AL00: before 9.1.0.331\(c675e9r1p3t8\) — fixed in 9.1.0.331\(c675e9r1p3t8\)
Huawei Berkeley-L09 Firmware: before 10.0.1.1\(c675r1\) — fixed in 10.0.1.1\(c675r1\)
Huawei Cd16-10 Firmware: before 10.0.2.8 — fixed in 10.0.2.8
Huawei Cd17-10 Firmware: before 10.0.2.8 — fixed in 10.0.2.8
Huawei Cd17-16 Firmware: before 10.0.2.8 — fixed in 10.0.2.8
Huawei Cd18-10 Firmware: before 10.0.2.8 — fixed in 10.0.2.8
Huawei Cd18-16 Firmware: before 10.0.2.8 — fixed in 10.0.2.8
Huawei Columbia-Tl00B Firmware: before 9.0.0.187\(c01e181r1p20t8\) — fixed in 9.0.0.187\(c01e181r1p20t8\)
E6878-370: before 10.0.5.1\(h610sp10c00\) — fixed in 10.0.5.1\(h610sp10c00\)
Huawei Honor 10 Lite Firmware: before 10.0.0.182\(c675e17r2p2\) — fixed in 10.0.0.182\(c675e17r2p2\)
Huawei Lelandp-L22A Firmware: before 9.1.0.166\(c675e5r1p4t8\) — fixed in 9.1.0.166\(c675e5r1p4t8\)
Huawei Tc5200-16 Firmware: before 10.0.2.8 — fixed in 10.0.2.8
Huawei Ws5200-11 Firmware: before 10.0.2.8; before 10.0.2.23 — fixed in 10.0.2.23, 10.0.2.8
Huawei Ws5200-16 Firmware: before 10.0.2.8 — fixed in 10.0.2.8
Huawei Ws5200-17 Firmware: before 10.0.2.23 — fixed in 10.0.2.23
WS5800-10: before 10.0.3.27 — fixed in 10.0.3.27
Huawei Ws6500-10 Firmware: before 10.0.2.8 — fixed in 10.0.2.8
Huawei Ws6500-16 Firmware: before 10.0.2.8 — fixed in 10.0.2.8

How to fix

Upgrade to a fixed version: Huawei Technologies Co., Ltd. Anne-AL00 9.1.0.331\(c675e9r1p3t8\); Huawei Berkeley-L09 Firmware 10.0.1.1\(c675r1\); Huawei Cd16-10 Firmware 10.0.2.8; Huawei Cd17-10 Firmware 10.0.2.8; Huawei Cd17-16 Firmware 10.0.2.8; Huawei Cd18-10 Firmware 10.0.2.8; Huawei Cd18-16 Firmware 10.0.2.8; Huawei Columbia-Tl00B Firmware 9.0.0.187\(c01e181r1p20t8\); E6878-370 10.0.5.1\(h610sp10c00\); Huawei Honor 10 Lite Firmware 10.0.0.182\(c675e17r2p2\); Huawei Lelandp-L22A Firmware 9.1.0.166\(c675e5r1p4t8\); Huawei Tc5200-16 Firmware 10.0.2.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-9069 or the next vulnerability affects your stack