CVE-2020-1812

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

HUAWEI P30 smartphones with versions earlier than 10.0.0.173(C00E73R1P11) have an improper authentication vulnerability. Due to improperly validation of certain application, an attacker should trick the user into installing a malicious application to exploit this vulnerability. Successful exploit could allow the attacker to bypass the authentication to perform unauthorized operations.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Feb 18, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-181218.8A configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files, leading to getshell.CVE-2020-181236.5A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily delete admin accounts.CVE-2020-181245.7A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily reset account passwords.CVE-2020-181256.1A reflected cross-site scripting (XSS) vulnerability in the /plugin/ajax.php component of Indexhibit 2.1.5 allows attackers to execute arbit CVE-2020-181265.4Multiple stored cross-site scripting (XSS) vulnerabilities in the Sections module of Indexhibit 2.1.5 allows attackers to execute arbitrary CVE-2020-181276.5An issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily view files.CVE-2020-181298.8A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php.CVE-2020-18136.8HUAWEI P30 smart phone with versions earlier than 10.1.0.135(C00E135R2P11) have an improper authentication vulnerability. Due to improper au CVE-2020-181318.8Cross Site Request Forgery (CSRF) vulnerability in Bluethrust Clan Scripts v4 allows attackers to escilate privledges to an arbitrary accoun CVE-2020-181324.8Cross Site Scripting (XSS) vulnerability in MIPCMS 3.6.0 allows attackers to execute arbitrary code via the category name field to categoryE CVE-2020-18145.3Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C CVE-2020-181449.8SQL Injection Vulnerability in ECTouch v2 via the integral_min parameter in index.php.