Skip to content
Fencer Vulns
high 7.8

CVE-2020-9247 json

There is a buffer overflow vulnerability in several Huawei products.

published 2020-12-07 5 y ago modified 2026-06-17 4 mo ago also EUVD-2020-30076

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits
0
none known

Summary

There is a buffer overflow vulnerability in several Huawei products. The system does not sufficiently validate certain configuration parameter which is passed from user that would cause buffer overflow. The attacker should trick the user into installing and running a malicious application with a high privilege, successful exploit may cause code execution. Affected product include Huawei HONOR 20 PRO, Mate 20, Mate 20 Pro, Mate 20 X, P30, P30 Pro, Hima-L29C, Laya-AL00EP, Princeton-AL10B, Tony-AL00B, Yale-L61A, Yale-TL00B and YaleP-AL10B.

Patch / fix

  • Huawei HONOR 20 PRO 10.1.0.230(C432E9R5P1), 10.1.0.231(C10E3R3P2)
  • Huawei HUAWEI Mate 20 10.1.0.160(C00E160R3P8)
  • Huawei HUAWEI Mate 20 Pro 10.1.0.270(C432E7R1P5), 10.1.0.270(C635E3R1P5), 10.1.0.273(C185E7R2P4), 10.1.0.273(C636E7R2P4), 10.1.0.277(C10E7R2P4), 10.1.0.277(C605E7R1P5)
  • Huawei HUAWEI Mate 20 X 10.1.0.160(C00E160R2P8)
  • Huawei HUAWEI P30 10.1.0.123(C432E22R2P5), 10.1.0.126(C10E7R5P1), 10.1.0.126(C185E4R7P1), 10.1.0.126(C605E19R1P3), 10.1.0.126(C636E5R3P4), 10.1.0.126(C636E7R3P4)
  • Huawei HUAWEI P30 Pro 10.1.0.160(C00E160R2P8)
  • Huawei Hima-L29C 10.1.0.273(C185E5R2P4), 10.1.0.273(C636E5R2P4), 10.1.0.275(C10E4R2P4)
  • Huawei Laya-AL00EP 10.1.0.160(C786E160R3P8)
  • Huawei Princeton-AL10B 10.1.0.160(C00E160R2P11)
  • Huawei Tony-AL00B 10.1.0.160(C00E160R2P11)
  • Huawei Yale-L61A 10.1.0.225(C432E3R1P2), 10.1.0.226(C10E3R1P1)
  • Huawei Yale-TL00B 10.1.0.160(C01E160R8P12)
  • Huawei YaleP-AL10B 10.1.0.160(C00E160R8P12)

Exploit prediction

0.83% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • Huawei HONOR 20 PRO
  • Huawei HUAWEI Mate 20
  • Huawei HUAWEI Mate 20 Pro
  • Huawei HUAWEI Mate 20 X
  • Huawei HUAWEI P30
  • Huawei HUAWEI P30 Pro
  • Huawei Hima-L29C
  • Huawei Laya-AL00EP
  • Huawei Princeton-AL10B
  • Huawei Tony-AL00B
  • Huawei Yale-L61A
  • Huawei Yale-TL00B
  • Huawei YaleP-AL10B

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.