Description:

Huawei has released security updates to address vulnerabilities in the following products:

• HUAWEI Mate 20 Smartphones
• Honor V30 Smartphones
• Emily-AL00A
• Hima-AL00B
• Sydney-L21, Sydney-L21BR, Sydney-L22, Sydney-L22BR, SydneyM-AL00, SydneyM-L01, SydneyM-L21, SydneyM-L22, SydneyM-L23
• Tony-AL00B
• USG9500
• C30
• ALP-AL00B, ALP-L09, ALP-L29
• Anne-AL00
• BLA-AL00B, BLA-L09C, BLA-L29C
• Berkeley-AL20, Berkeley-L09
• Emily-L29C
• Figo-L03, Figo-L21, Figo-L23, Figo-L31
• Florida-L03, Florida-L21, Florida-L22, Florida-L23
• HUAWEI P smart, HUAWEI P smart,HUAWEI Y7s
• HUAWEI P20 lite
• HUAWEI nova 3e,HUAWEI P20 lite
• Honor View 10
• Leland-AL00A, Leland-L21A, Leland-L22A, Leland-L22C, Leland-L31A
• Atomu-L03, Atomu-L11, Atomu-L21, Atomu-L23, Atomu-L29A, Atomu-L41, Atomu-L42
• BLA-L09C, BLA-L29C
• Charlotte-L09C, Charlotte-L29C
• Duke-L09
• Emily-L09C, Emily-L29C
• EulerOS
• Figo-L11
• FusionSphere OpenStack
• HUAWEI P20, HUAWEI P20 Pro
• HUAWEI Y6 2018, HUAWEI Y6 Prime 2018, HUAWEI Y7 2018
• Leland-AL10B
• London-AL40B
• Selina-L02
• Toronto-L01, Toronto-L03, Toronto-L21, Toronto-L22, Toronto-L23
• AR120-S, AR1200, AR1200-S, AR150, AR150-S, AR160, AR200, AR200-S, AR2200, AR2200-S, AR3200, AR3600, AR510
• DP300
• IPS Module
• NGFW Module
• NIP6300, NIP6600, NIP6800
• NetEngine16EX
• RSE6500
• SMC2.0
• SRG1300, SRG2300, SRG3300
• SVN5600, SVN5800, SVN5800-C
• SeMG9811
• Secospace USG6300, Secospace USG6500, Secospace USG6600
• SoftCo
• TE30, TE40, TE50, TE60
• TP3206
• USG9500, USG9520, USG9560
• VP9660
• ViewPoint 8660, ViewPoint 9030
• eSpace U1910, eSpace U1911, eSpace U1930, eSpace U1960, eSpace U1980, eSpace U1981
• CloudEngine 12800, CloudEngine 5800, CloudEngine 6800, CloudEngine 7800
• DBS3900 TDD LTE
• DP300
• RP200
• TE30, TE40, TE50, TE60

Threats:

Attacker could exploit these vulnerabilities by doing the following:

• Cause information leak and compromise the availability of the smart phones.
• Unauthorized disclosure of information
• Buffer overflow
• Bypass of a protection mechanism
• Denial of service attack (DoS) - remotely

Best practice and Recommendations:

• The product that supports automatic update will receive a system update prompt. You can install the update to fix the vulnerability.
• Update Smartphone https://consumer.huawei.com/en/support/update/

The CERT team encourages users to review Huawei security advisory and apply the necessary updates:

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-pagecache-en

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-firewall-en

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-qemu-en

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-frp-en

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-smartphone-en

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-02-smartphone-en

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-linux-en

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-sip-en

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-ldap-en