CVE-2020-9081

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-27 · updated 2026-06-17
Weakness: CWE-285

Description

There is an improper authorization vulnerability in some Huawei smartphones. An attacker could perform a series of operation in specific mode to exploit this vulnerability. Successful exploit could allow the attacker to bypass app lock. (Vulnerability ID: HWPSIRT-2019-12144) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9081.

Affected products

HUAWEI Mate 20: before 10.1.0.160\(c00e160r3p8\); before 10.1.0.160\(c01e160r2p8\) — fixed in 10.1.0.160\(c00e160r3p8\), 10.1.0.160\(c01e160r2p8\)
HUAWEI P30: before 10.1.0.160\(c00e160r2p11\) — fixed in 10.1.0.160\(c00e160r2p11\)
HUAWEI P30 Pro: before 10.1.0.160\(c00e160r2p8\); before 10.1.0.160\(c01e160r2p8\) — fixed in 10.1.0.160\(c00e160r2p8\), 10.1.0.160\(c01e160r2p8\)
Huawei Princeton-Al10D Firmware: before 10.1.0.160\(c00e160r2p11\) — fixed in 10.1.0.160\(c00e160r2p11\)
Huawei Yale-Al00A Firmware: before 10.1.0.160\(c00e160r8p12\) — fixed in 10.1.0.160\(c00e160r8p12\)
Huawei Yale-Al50A Firmware: before 10.1.0.88\(c00e88r8p1\) — fixed in 10.1.0.88\(c00e88r8p1\)
Huawei Yalep-Al10B Firmware: before 10.1.0.160\(c00e160r8p12\) — fixed in 10.1.0.160\(c00e160r8p12\)

How to fix

Upgrade to a fixed version: HUAWEI Mate 20 10.1.0.160\(c00e160r3p8\), 10.1.0.160\(c01e160r2p8\); HUAWEI P30 10.1.0.160\(c00e160r2p11\); HUAWEI P30 Pro 10.1.0.160\(c00e160r2p8\), 10.1.0.160\(c01e160r2p8\); Huawei Princeton-Al10D Firmware 10.1.0.160\(c00e160r2p11\); Huawei Yale-Al00A Firmware 10.1.0.160\(c00e160r8p12\); Huawei Yale-Al50A Firmware 10.1.0.88\(c00e88r8p1\); Huawei Yalep-Al10B Firmware 10.1.0.160\(c00e160r8p12\). Check the vendor advisory for mitigations.

References

https://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200826-15-smartphone-en

Get alerted when CVE-2020-9081 or the next vulnerability affects your stack