CVE-2020-9260

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

HUAWEI P30 and HUAWEI P30 Pro smartphones with versions earlier than 10.1.0.123(C432E22R2P5) and versions earlier than 10.1.0.160(C00E160R2P8) have an information disclosure vulnerability. Certain WI-FI function's default configuration in the system seems insecure, an attacker should craft a WI-FI hotspot to launch the attack. Successful exploit could cause information disclosure.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	HUAWEI P30;HUAWEI P30 Pro	Versions earlier than 10.1.0.123(C432E22R2P5); Versions earlier than 10.1.0.160(C00E160R2P8)

References

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200708-01-smartphone-enVendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200708-01-smartphone-enVendor Advisory

Timeline

Published: Jul 10, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-92617.8HUAWEI Mate 30 with versions earlier than 10.1.0.150(C00E136R5P3) have a type confusion vulnerability. The system does not properly check an CVE-2020-92627.8HUAWEI Mate 30 with versions earlier than 10.1.0.150(C00E136R5P3) have a use after free vulnerability. There is a condition exists that the CVE-2020-92637.8HUAWEI Mate 30 versions earlier than 10.1.0.150(C00E136R5P3) and HUAWEI P30 version earlier than 10.1.0.160(C00E160R2P11) have a use after f CVE-2020-92645.5ESET Archive Support Module before 1296 allows virus-detection bypass via a crafted Compression Information Field in a ZIP archive. This aff CVE-2020-92658.2phpMyChat-Plus 1.98 is vulnerable to multiple SQL injections against the deluser.php Delete User functionality, as demonstrated by pmc_usern CVE-2020-92666.5SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajax_server.php.CVE-2020-92676.5SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajax_server.php.CVE-2020-92687.5SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nom_createur&by= substring.CVE-2020-92697.2SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by exp CVE-2020-92708.8ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php.CVE-2020-92716.5ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php.CVE-2020-92727.5ProFTPD 1.3.7 has an out-of-bounds (OOB) read vulnerability in mod_cap via the cap_text.c cap_to_text function.