1. Home
  2. CVE Database
  3. CVE-2020-9247
HIGH · 7.8

CVE-2020-9247

There is a buffer overflow vulnerability in several Huawei products. The system does not sufficiently validate certain configuration parameter which is passed from user that would cause buffer overflo...

Vulnerability Description

There is a buffer overflow vulnerability in several Huawei products. The system does not sufficiently validate certain configuration parameter which is passed from user that would cause buffer overflow. The attacker should trick the user into installing and running a malicious application with a high privilege, successful exploit may cause code execution. Affected product include Huawei HONOR 20 PRO, Mate 20, Mate 20 Pro, Mate 20 X, P30, P30 Pro, Hima-L29C, Laya-AL00EP, Princeton-AL10B, Tony-AL00B, Yale-L61A, Yale-TL00B and YaleP-AL10B.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
HuaweiHonor 20 Pro Firmware< 10.1.0.230\(c432e9r5p1\)
HuaweiHonor 20 Pro-
HuaweiMate 20 Firmware< 10.1.0.160\(c00e160r3p8\)
HuaweiMate 20-
HuaweiMate 20 Pro Firmware< 10.1.0.270\(c432e7r1p5\)
HuaweiMate 20 Pro-
HuaweiMate 20 X Firmware< 10.1.0.160\(c00e160r2p8\)
HuaweiMate 20 X-
HuaweiP30 Firmware9.1.0.272\(c635e4r2p2\)
HuaweiP30-
HuaweiP30 Pro Firmware< 10.1.0.160\(c00e160r2p8\)
HuaweiP30 Pro-
HuaweiHima-L29C Firmware< 10.1.0.273\(c185e5r2p4\)
HuaweiHima-L29C-
HuaweiLaya-Al00Ep Firmware< 10.1.0.160\(c786e160r3p8\)
HuaweiLaya-Al00Ep-
HuaweiPrinceton-Al10B Firmware< 10.1.0.160\(c00e160r2p11\)
HuaweiPrinceton-Al10B-
HuaweiTony-Al00B Firmware< 10.1.0.160\(c00e160r2p11\)
HuaweiTony-Al00B-

Related Weaknesses (CWE)

CWE-120

References

FAQ

What is CVE-2020-9247?

CVE-2020-9247 is a vulnerability with a CVSS score of 7.8 (HIGH). There is a buffer overflow vulnerability in several Huawei products. The system does not sufficiently validate certain configuration parameter which is passed from user that would cause buffer overflo...

How severe is CVE-2020-9247?

CVE-2020-9247 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-9247?

Check the references section above for vendor advisories and patch information. Affected products include: Huawei Honor 20 Pro Firmware, Huawei Honor 20 Pro, Huawei Mate 20 Firmware, Huawei Mate 20, Huawei Mate 20 Pro Firmware.