Huawei Berkeley-l09 Firmware vulnerabilities

8 CVEs affecting Huawei Berkeley-l09 Firmware, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-9239, published 2020-09-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-2215: Android Kernel Use-After-Free Vulnerability, published 2019-10-11. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 72.1% chance of exploitation in the next 30 days. A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require…
CVE-2020-0069: Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability, published 2020-03-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 1.4% chance of exploitation in the next 30 days. In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local…
CVE-2019-9506, published 2019-08-14. High severity, CVSS 8.1. EPSS: 2.7% chance of exploitation in the next 30 days. The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This…
CVE-2020-9069, published 2020-05-21. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. There is an information leakage vulnerability in some Huawei products. An unauthenticated, adjacent attacker could exploit this vulnerability to decrypt data. Successful exploitation may leak…
CVE-2019-5303, published 2020-04-27. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. There are two denial of service vulnerabilities on some Huawei smartphones. An attacker may send specially crafted TD-SCDMA messages from a rogue base station to the affected devices. Due to…
CVE-2019-5302, published 2020-04-27. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. There are two denial of service vulnerabilities on some Huawei smartphones. An attacker may send specially crafted TD-SCDMA messages from a rogue base station to the affected devices. Due to…
CVE-2020-9239, published 2020-09-11. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Huawei smartphones BLA-A09 versions 8.0.0.123(C212),versions earlier than 8.0.0.123(C567),versions earlier than 8.0.0.123(C797);BLA-TL00B versions earlier than 8.1.0.326(C01);Berkeley-L09 versions…
CVE-2019-19412, published 2020-06-08. Medium severity, CVSS 4.6. EPSS: 0.2% chance of exploitation in the next 30 days. Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker login the…