Details of VAR-202005-0971

ID

VAR-202005-0971

CVE

CVE-2020-9069

TITLE

plural Huawei Information leakage vulnerabilities in products

Trust: 0.8

sources: JVNDB: JVNDB-2020-005593

DESCRIPTION

There is an information leakage vulnerability in some Huawei products. An unauthenticated, adjacent attacker could exploit this vulnerability to decrypt data. Successful exploitation may leak information randomly. Affected product versions include: Anne-AL00 Versions earlier than 9.1.0.331(C675E9R1P3T8); Berkeley-L09 Versions earlier than 10.0.1.1(C675R1); CD16-10 Versions earlier than 10.0.2.8; CD17-10 Versions earlier than 10.0.2.8; CD17-16 Versions earlier than 10.0.2.8; CD18-10 Versions earlier than 10.0.2.8; CD18-16 Versions earlier than 10.0.2.8; Columbia-TL00B Versions earlier than 9.0.0.187(C01E181R1P20T8); E6878-370 Versions earlier than 10.0.5.1(H610SP10C00); HUAWEI P30 lite Versions earlier than 10.0.0.185(C605E3R1P3), Versions earlier than 10.0.0.197(C432E8R2P7); HUAWEI nova 4e Versions earlier than 10.0.0.158(C00E64R1P9); Honor 10 Lite 9.0.1.113(C675E11R1P12); LelandP-L22A Versions earlier than 9.1.0.166(C675E5R1P4T8); Marie-AL00AX Versions earlier than 10.0.0.158(C00E64R1P9); Marie-AL00AY Versions earlier than 10.0.0.158(C00E64R1P9); Marie-AL00BX Versions earlier than 10.0.0.158(C00E64R1P9); Marie-L03BX Versions earlier than 10.0.0.188(C605E5R1P1); Marie-L21BX Versions earlier than 10.0.0.188(C432E4R4P1), Versions earlier than 10.0.0.188(C461E5R3P1); Marie-L22BX Versions earlier than 10.0.0.188(C636E3R3P1); Marie-L23BX Versions earlier than 10.0.0.188(C605E5R1P1); TC5200-16 Versions earlier than 10.0.2.8; WS5200-11 Versions earlier than 10.0.2.8; WS5200-12 Versions earlier than 10.0.2.23; WS5200-16 Versions earlier than 10.0.2.8; WS5200-17 Versions earlier than 10.0.2.23; WS5800-10 Versions earlier than 10.0.3.27; WS6500-10 Versions earlier than 10.0.2.8; WS6500-16 Versions earlier than 10.0.2.8. Huawei Anne-AL00 and other products are products of China's Huawei company. Huawei Anne-AL00 is a smartphone. Honor 10 Lite is a smartphone. Huawei TC5200-16 is a wireless router

Trust: 2.16

sources: NVD: CVE-2020-9069 // JVNDB: JVNDB-2020-005593 // CNVD: CNVD-2020-36726

IOT TAXONOMY

category:

['IoT']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-36726

AFFECTED PRODUCTS

vendor:	huawei	model:	marie-l21bx <=10.0.0.188	scope:	-	version:	-	Trust: 1.2
vendor:	huawei	model:	honor 10 lite	scope:	lt	version:	10.0.0.182\(c675e17r2p2\)	Trust: 1.0
vendor:	huawei	model:	ws5800-10	scope:	lt	version:	10.0.3.27	Trust: 1.0
vendor:	huawei	model:	columbia-tl00b	scope:	lt	version:	9.0.0.187\(c01e181r1p20t8\)	Trust: 1.0
vendor:	huawei	model:	ws5200-16	scope:	lt	version:	10.0.2.8	Trust: 1.0
vendor:	huawei	model:	ws6500-16	scope:	lt	version:	10.0.2.8	Trust: 1.0
vendor:	huawei	model:	cd16-10	scope:	lt	version:	10.0.2.8	Trust: 1.0
vendor:	huawei	model:	cd17-10	scope:	lt	version:	10.0.2.8	Trust: 1.0
vendor:	huawei	model:	cd18-10	scope:	lt	version:	10.0.2.8	Trust: 1.0
vendor:	huawei	model:	tc5200-16	scope:	lt	version:	10.0.2.8	Trust: 1.0
vendor:	huawei	model:	e6878-370	scope:	lt	version:	10.0.5.1\(h610sp10c00\)	Trust: 1.0
vendor:	huawei	model:	anne-al00	scope:	lt	version:	9.1.0.331\(c675e9r1p3t8\)	Trust: 1.0
vendor:	huawei	model:	cd18-16	scope:	lt	version:	10.0.2.8	Trust: 1.0
vendor:	huawei	model:	ws5200-17	scope:	lt	version:	10.0.2.23	Trust: 1.0
vendor:	huawei	model:	ws5200-11	scope:	lt	version:	10.0.2.23	Trust: 1.0
vendor:	huawei	model:	cd17-16	scope:	lt	version:	10.0.2.8	Trust: 1.0
vendor:	huawei	model:	berkeley-l09	scope:	lt	version:	10.0.1.1\(c675r1\)	Trust: 1.0
vendor:	huawei	model:	ws5200-11	scope:	lt	version:	10.0.2.8	Trust: 1.0
vendor:	huawei	model:	lelandp-l22a	scope:	lt	version:	9.1.0.166\(c675e5r1p4t8\)	Trust: 1.0
vendor:	huawei	model:	ws6500-10	scope:	lt	version:	10.0.2.8	Trust: 1.0
vendor:	huawei	model:	anne-al00	scope:	eq	version:	9.1.0.331(c675e9r1p3t8)	Trust: 0.8
vendor:	huawei	model:	berkeley-l09	scope:	eq	version:	10.0.1.1(c675r1)	Trust: 0.8
vendor:	huawei	model:	cd16-10	scope:	eq	version:	10.0.2.8	Trust: 0.8
vendor:	huawei	model:	cd17-10	scope:	eq	version:	10.0.2.8	Trust: 0.8
vendor:	huawei	model:	cd17-16	scope:	eq	version:	10.0.2.8	Trust: 0.8
vendor:	huawei	model:	cd18-10	scope:	eq	version:	10.0.2.8	Trust: 0.8
vendor:	huawei	model:	cd18-16	scope:	eq	version:	10.0.2.8	Trust: 0.8
vendor:	huawei	model:	columbia-tl00b	scope:	eq	version:	9.0.0.187(c01e181r1p20t8)	Trust: 0.8
vendor:	huawei	model:	e6878-370	scope:	eq	version:	10.0.5.1(h610sp10c00)	Trust: 0.8
vendor:	huawei	model:	honor 10 lite	scope:	eq	version:	9.0.1.113(c675e11r1p12)	Trust: 0.8
vendor:	huawei	model:	anne-al00 <=9.1.0.331	scope:	-	version:	-	Trust: 0.6
vendor:	huawei	model:	berkeley-l09 <=10.0.1.1	scope:	-	version:	-	Trust: 0.6
vendor:	huawei	model:	cd16-10	scope:	lte	version:	<=10.0.2.8	Trust: 0.6
vendor:	huawei	model:	cd17-10	scope:	lte	version:	<=10.0.2.8	Trust: 0.6
vendor:	huawei	model:	cd17-16	scope:	lte	version:	<=10.0.2.8	Trust: 0.6
vendor:	huawei	model:	cd18-10	scope:	lte	version:	<=10.0.2.8	Trust: 0.6
vendor:	huawei	model:	cd18-16	scope:	lte	version:	<=10.0.2.8	Trust: 0.6
vendor:	huawei	model:	columbia-tl00b <=9.0.0.187	scope:	-	version:	-	Trust: 0.6
vendor:	huawei	model:	e6878-370 <=10.0.5.1	scope:	-	version:	-	Trust: 0.6
vendor:	huawei	model:	p30 lite <=10.0.0.185	scope:	-	version:	-	Trust: 0.6
vendor:	huawei	model:	p30 lite <=10.0.0.197	scope:	-	version:	-	Trust: 0.6
vendor:	huawei	model:	nova 4e <=10.0.0.158	scope:	-	version:	-	Trust: 0.6
vendor:	huawei	model:	honor lite 9.0.1.113	scope:	eq	version:	10	Trust: 0.6
vendor:	huawei	model:	lelandp-l22a <=9.1.0.166	scope:	-	version:	-	Trust: 0.6
vendor:	huawei	model:	marie-al00ax <=10.0.0.158	scope:	-	version:	-	Trust: 0.6
vendor:	huawei	model:	marie-al00bx <=10.0.0.158	scope:	-	version:	-	Trust: 0.6
vendor:	huawei	model:	marie-l22bx <=10.0.0.188	scope:	-	version:	-	Trust: 0.6
vendor:	huawei	model:	marie-l23bx <=10.0.0.188	scope:	-	version:	-	Trust: 0.6
vendor:	huawei	model:	tc5200-16	scope:	lte	version:	<=10.0.2.8	Trust: 0.6
vendor:	huawei	model:	ws5200-11	scope:	lte	version:	<=10.0.2.8	Trust: 0.6
vendor:	huawei	model:	ws5200-12	scope:	lte	version:	<=10.0.2.23	Trust: 0.6
vendor:	huawei	model:	ws5200-16	scope:	lte	version:	<=10.0.2.8	Trust: 0.6
vendor:	huawei	model:	ws5200-17	scope:	lte	version:	<=10.0.2.23	Trust: 0.6
vendor:	huawei	model:	ws5800-10	scope:	lte	version:	<=10.0.3.27	Trust: 0.6
vendor:	huawei	model:	ws6500-10	scope:	lte	version:	<=10.0.2.8	Trust: 0.6
vendor:	huawei	model:	ws6500-16	scope:	lte	version:	<=10.0.2.8	Trust: 0.6

sources: CNVD: CNVD-2020-36726 // JVNDB: JVNDB-2020-005593 // NVD: CVE-2020-9069

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-9069
value:	MEDIUM
Trust: 1.0
NVD:	JVNDB-2020-005593
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2020-36726
value:	LOW
Trust: 0.6
CNNVD:	CNNVD-202005-1099
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2020-9069
severity:	LOW
baseScore:	3.3
vectorString:	AV:A/AC:L/AU:N/C:P/I:N/A:N
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	6.5
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2020-005593
severity:	LOW
baseScore:	3.3
vectorString:	AV:A/AC:L/AU:N/C:P/I:N/A:N
accessVector:	ADJACENT NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2020-36726
severity:	LOW
baseScore:	3.3
vectorString:	AV:A/AC:L/AU:N/C:P/I:N/A:N
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	6.5
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2020-9069
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	JVNDB-2020-005593
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-36726 // JVNDB: JVNDB-2020-005593 // CNNVD: CNNVD-202005-1099 // NVD: CVE-2020-9069

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-200	Trust: 0.8

sources: JVNDB: JVNDB-2020-005593 // NVD: CVE-2020-9069

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202005-1099

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-202005-1099

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-005593

PATCH

title:	huawei-sa-20200520-01-leakage	url:	https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200520-01-leakage-en	Trust: 0.8
title:	Patch for Multiple Huawei product information disclosure vulnerabilities (CNVD-2020-36726)	url:	https://www.cnvd.org.cn/patchInfo/show/224779	Trust: 0.6
title:	Multiple Huawei Product information disclosure vulnerability repair measures	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=119391	Trust: 0.6

sources: CNVD: CNVD-2020-36726 // JVNDB: JVNDB-2020-005593 // CNNVD: CNNVD-202005-1099

EXTERNAL IDS

db:	NVD	id:	CVE-2020-9069	Trust: 3.0
db:	JVNDB	id:	JVNDB-2020-005593	Trust: 0.8
db:	CNVD	id:	CNVD-2020-36726	Trust: 0.6
db:	CNNVD	id:	CNNVD-202005-1099	Trust: 0.6

sources: CNVD: CNVD-2020-36726 // JVNDB: JVNDB-2020-005593 // CNNVD: CNNVD-202005-1099 // NVD: CVE-2020-9069

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2020-9069	Trust: 2.0
url:	https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200520-01-leakage-en	Trust: 1.6
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-9069	Trust: 0.8
url:	https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20200520-01-leakage-cn	Trust: 0.6

sources: CNVD: CNVD-2020-36726 // JVNDB: JVNDB-2020-005593 // CNNVD: CNNVD-202005-1099 // NVD: CVE-2020-9069

SOURCES

db:	CNVD	id:	CNVD-2020-36726
db:	JVNDB	id:	JVNDB-2020-005593
db:	CNNVD	id:	CNNVD-202005-1099
db:	NVD	id:	CVE-2020-9069

LAST UPDATE DATE

2024-11-23T21:51:28.931000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-36726	date:	2020-07-07T00:00:00
db:	JVNDB	id:	JVNDB-2020-005593	date:	2020-06-18T00:00:00
db:	CNNVD	id:	CNNVD-202005-1099	date:	2020-07-30T00:00:00
db:	NVD	id:	CVE-2020-9069	date:	2024-11-21T05:39:57.940

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-36726	date:	2020-07-07T00:00:00
db:	JVNDB	id:	JVNDB-2020-005593	date:	2020-06-18T00:00:00
db:	CNNVD	id:	CNNVD-202005-1099	date:	2020-05-20T00:00:00
db:	NVD	id:	CVE-2020-9069	date:	2020-05-21T15:15:10.123