How severe is CVE-2020-9069?

CVE-2020-9069 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2020-9069 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (26th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-9069?

CVE-2020-9069 primarily affects Huawei Anne-al00 Firmware. In total, 18 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2020-9069?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-9069 published?

CVE-2020-9069 was published on 2020-05-21 and last updated on 2026-06-17.

CVE-2020-9069

CVE-2020-9069 is a medium-severity vulnerability in Huawei Anne-al00 Firmware with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 3.3
EPSS exploit prediction: 0% (26th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Huawei Anne-al00 Firmware
Published: 2020-05-21
Last modified: 2026-06-17

Description

There is an information leakage vulnerability in some Huawei products. An unauthenticated, adjacent attacker could exploit this vulnerability to decrypt data. Successful exploitation may leak information randomly. Affected product versions include: Anne-AL00 Versions earlier than 9.1.0.331(C675E9R1P3T8); Berkeley-L09 Versions earlier than 10.0.1.1(C675R1); CD16-10 Versions earlier than 10.0.2.8; CD17-10 Versions earlier than 10.0.2.8; CD17-16 Versions earlier than 10.0.2.8; CD18-10 Versions earlier than 10.0.2.8; CD18-16 Versions earlier than 10.0.2.8; Columbia-TL00B Versions earlier than 9.0.0.187(C01E181R1P20T8); E6878-370 Versions earlier than 10.0.5.1(H610SP10C00); HUAWEI P30 lite Versions earlier than 10.0.0.185(C605E3R1P3), Versions earlier than 10.0.0.197(C432E8R2P7); HUAWEI nova 4e Versions earlier than 10.0.0.158(C00E64R1P9); Honor 10 Lite 9.0.1.113(C675E11R1P12); LelandP-L22A Versions earlier than 9.1.0.166(C675E5R1P4T8); Marie-AL00AX Versions earlier than 10.0.0.158(C00E64R1P9); Marie-AL00AY Versions earlier than 10.0.0.158(C00E64R1P9); Marie-AL00BX Versions earlier than 10.0.0.158(C00E64R1P9); Marie-L03BX Versions earlier than 10.0.0.188(C605E5R1P1); Marie-L21BX Versions earlier than 10.0.0.188(C432E4R4P1), Versions earlier than 10.0.0.188(C461E5R3P1); Marie-L22BX Versions earlier than 10.0.0.188(C636E3R3P1); Marie-L23BX Versions earlier than 10.0.0.188(C605E5R1P1); TC5200-16 Versions earlier than 10.0.2.8; WS5200-11 Versions earlier than 10.0.2.8; WS5200-12 Versions earlier than 10.0.2.23; WS5200-16 Versions earlier than 10.0.2.8; WS5200-17 Versions earlier than 10.0.2.23; WS5800-10 Versions earlier than 10.0.3.27; WS6500-10 Versions earlier than 10.0.2.8; WS6500-16 Versions earlier than 10.0.2.8

Frequently asked questions

What is CVE-2020-9069?: There is an information leakage vulnerability in some Huawei products. An unauthenticated, adjacent attacker could exploit this vulnerability to decrypt data. Successful exploitation may leak information randomly. Affected product versions include: Anne-AL00 Versions earlier than 9.1.0.331(C675E9R1P3T8); Berkeley-L09 Versions earlier than 10.0.1.1(C675R1); CD16-10 Versions earlier than 10.0.2.8; CD17-10 Versions earlier than 10.0.2.8; CD17-16 Versions earlier than 10.0.2.8; CD18-10 Versions earlier than 10.0.2.8; CD18-16 Versions earlier than 10.0.2.8; Columbia-TL00B Versions earlier than 9.0.0.187(C01E181R1P20T8); E6878-370 Versions earlier than 10.0.5.1(H610SP10C00); HUAWEI P30 lite Versions earlier than 10.0.0.185(C605E3R1P3), Versions earlier than 10.0.0.197(C432E8R2P7); HUAWEI nova 4e Versions earlier than 10.0.0.158(C00E64R1P9); Honor 10 Lite 9.0.1.113(C675E11R1P12); LelandP-L22A Versions earlier than 9.1.0.166(C675E5R1P4T8); Marie-AL00AX Versions earlier than 10.0.0.158(C00E64R1P9); Marie-AL00AY Versions earlier than 10.0.0.158(C00E64R1P9); Marie-AL00BX Versions earlier than 10.0.0.158(C00E64R1P9); Marie-L03BX Versions earlier than 10.0.0.188(C605E5R1P1); Marie-L21BX Versions earlier than 10.0.0.188(C432E4R4P1), Versions earlier than 10.0.0.188(C461E5R3P1); Marie-L22BX Versions earlier than 10.0.0.188(C636E3R3P1); Marie-L23BX Versions earlier than 10.0.0.188(C605E5R1P1); TC5200-16 Versions earlier than 10.0.2.8; WS5200-11 Versions earlier than 10.0.2.8; WS5200-12 Versions earlier than 10.0.2.23; WS5200-16 Versions earlier than 10.0.2.8; WS5200-17 Versions earlier than 10.0.2.23; WS5800-10 Versions earlier than 10.0.3.27; WS6500-10 Versions earlier than 10.0.2.8; WS6500-16 Versions earlier than 10.0.2.8
How severe is CVE-2020-9069?: CVE-2020-9069 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2020-9069 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (26th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-9069?: CVE-2020-9069 primarily affects Huawei Anne-al00 Firmware. In total, 18 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2020-9069?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-9069 published?: CVE-2020-9069 was published on 2020-05-21 and last updated on 2026-06-17.

References

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200520-01-leakage-en

Affected products (18)

cpe:2.3:o:huawei:anne-al00_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:berkeley-l09_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:cd16-10_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:cd17-10_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:cd17-16_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:cd18-10_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:cd18-16_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:columbia-tl00b_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:e6878-370_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:honor_10_lite_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:lelandp-l22a_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:tc5200-16_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:ws5200-11_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:ws5200-16_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:ws5200-17_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:ws5800-10_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:ws6500-10_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:ws6500-16_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Huawei Anne-al00 Firmware

CVE-2019-2215 — High (CVSS 7.8): A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user…
CVE-2019-19412 — Medium (CVSS 4.6): Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile…
CVE-2018-7924 — Low (CVSS 2.4): Anne-AL00 Huawei phones with versions earlier than 8.0.0.151(C00) have an information leak vulnerability. Due to…

All CVEs affecting Huawei Anne-al00 Firmware →