Existe una vulnerabilidad de gestión de privilegios incorrecta en el producto de teléfono inteligente Huawei. Un atacante local y autenticado podría crear una entrada específica para explotar esta vulnerabilidad. Explotación exitosa

Successful exploitation of CVE-2020-9080 allows a local, authenticated attacker to elevate their privileges on the Huawei Mate 20 Pro device. This means an attacker who already has some level of access to the phone (e.g., a user account) could gain root or administrator-level access. The attacker could then potentially access sensitive data, install malicious software, or modify system settings without proper authorization. While the vulnerability requires local access and authentication, the potential impact of privilege escalation is significant, allowing for complete control over the device's functionality and data.

Users of Huawei Mate 20 Pro devices running versions prior to 10.0.0.125(C01E123R7P3) are at risk. This includes individuals who have not yet applied security updates and organizations that manage fleets of these devices. Users who have enabled developer options or root access on their devices may be at higher risk.

• windows / supply-chain: Check for unusual process executions with elevated privileges. Monitor system logs for attempts to modify system files or settings. Use Sysinternals tools like Process Monitor to identify suspicious activity. • linux / server: Examine system logs (e.g., /var/log/auth.log) for unusual login attempts or privilege escalation patterns. Use auditd to monitor file system access and modifications. • generic web: N/A - This vulnerability is specific to the device's operating system and does not directly involve web components.

1. 2024-12-27Disclosure

   disclosure

1. Reservado2020-02-18
2. Publicada2024-12-27
3. EPSS actualizado2026-04-02

The primary mitigation for CVE-2020-9080 is to upgrade the Huawei Mate 20 Pro to version 10.0.1 or later. Huawei has released this update to address the vulnerability. If upgrading is not immediately possible, consider limiting user privileges and implementing stricter access controls to minimize the potential impact of a successful attack. While a direct workaround isn’t available, regular security audits and monitoring for suspicious activity are recommended. After upgrading, confirm the successful update by navigating to Settings > About Phone > Software Version and verifying the version number is 10.0.1 or higher.