一部のHuaweiスマートフォンに認証不十分な脆弱性があります。認証されていないローカル攻撃者が、ソフトウェアパッケージを作成してこの脆弱性を悪用できます。不十分な検証により

The primary impact of CVE-2020-9250 is the potential for a denial-of-service (DoS) condition. An attacker with local access to the device can craft a specially designed software package to trigger this vulnerability. This crafted package bypasses authentication checks, allowing the attacker to execute actions that could disrupt or halt the normal operation of the affected service. While the CVSS score is LOW, the local access requirement means that this vulnerability is most likely to be exploited in scenarios involving physical access or compromised devices within a local network. The impact is limited to the affected service on the device itself, preventing broader system compromise.

Users of Huawei Mate 20 Pro devices running versions prior to 10.1.0.160(C00E160R3P8) are at risk, particularly those who allow local software installation from untrusted sources or have weak physical security controls. Shared hosting environments where multiple users have access to the device are also at increased risk.

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.TaskName -like '*malicious*'} | Get-ScheduledTask | Disable-ScheduledTask

• linux / server:

journalctl -xe | grep -i 'authentication failure'

• generic web:

curl -I http://<device_ip>/ | grep -i 'authentication'

1. 2019-12-30Discovery

   discovery

2. 2020-01-01Disclosure

   disclosure

3. 2024-12-20Disclosure

   public disclosure

1. 予約済み2020-02-18
2. 公開日2024-12-20
3. EPSS 更新日2026-04-02

The primary mitigation for CVE-2020-9250 is to upgrade the Huawei Mate 20 Pro to version 10.1.0.160 or later. This update includes the necessary authentication checks to prevent the exploitation of this vulnerability. If an immediate upgrade is not possible due to compatibility concerns or device limitations, consider restricting local software installation and carefully scrutinizing any software packages installed on the device. While a WAF or proxy cannot directly mitigate this local vulnerability, ensuring the device's software sources are trusted can reduce the risk of malicious package installation. After upgrading, confirm the fix by attempting to install a known malicious package and verifying that the authentication check is enforced.