Secuno
ENNL
Book demo

CVE-2020-0069

Mediatek Multiple Chipsets Insufficient Input Validation

7.8 HIGHActively exploited (CISA KEV)EPSS 1.37%
  1. Published10 Mar 2020
  2. Added to CISA KEV3 Nov 2021
  3. Remediation due3 May 2022
Actively exploited (CISA KEV)

Multiple MediaTek chipsets contain an insufficient input validation vulnerability and have missing SELinux restrictions in the Command Queue drivers ioctl handlers. This causes an out-of-bounds write leading to privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0041 under exploit chain "AbstractEmu."

Added to KEV: 3 Nov 2021Federal remediation due: 3 May 2022

Description

In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754

CVSS 3.1 breakdown

Attack vectorLocal
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Google Androidall versions
Huawei Berkeley-l09 Firmware< 10.0.0.177\(c10e3r1p4\)
Huawei Columbia-al10b Firmware< 10.0.0.178\(c00e178r1p4\)
Huawei Columbia-l29d Firmware< 10.0.0.177\(c10e4r1p4\) · < 10.0.0.177\(c432e3r1p4\)
Huawei Columbia-tl00b Firmware< 10.0.0.178\(c01e178r1p4\)
Huawei Columbia-tl00d Firmware< 10.0.0.178\(c01e178r1p4\)
Huawei Cornell-al00a Firmware< 9.1.0.340\(c00e333r1p1t8\)
Huawei Cornell-tl10b Firmware< 9.1.0.340\(c01e333r1p1t8\)
Huawei Dura-al00a Firmware< 1.0.0.190\(c00\)
Huawei Honor 20 Pro Firmware< 10.0.0.194\(c636e3r3p1\) · < 10.0.0.202\(c10e3r3p2\)
Huawei Honor 8a Firmware< 9.1.0.291\(c185e3r4p1\) · < 9.1.0.291\(c432e5r2p1\) · < 9.1.0.291\(c636e4r4p1\) · < 9.1.0.297\(c605e4r4p2\)
Huawei Honor View 20 Firmware< 10.0.0.198\(c432e10r3p4\) · < 10.0.0.200\(c185e3r3p3\) · < 10.0.0.201\(c10e5r4p3\)
Huawei Jakarta-al00a Firmware< 9.1.0.251\(c00e106r2p2\)
Huawei Katyusha-al00a Firmware< 9.1.0.146\(c00e131r2p2\)
Huawei Katyusha-al10a Firmware< 9.1.0.160\(c00e150r1p7\)
Huawei Madrid-al00a Firmware< 9.1.0.261\(c00e120r4p1\)
Huawei Nova 3 Firmware< 9.1.0.338\(c00e333r1p1t8\)
Huawei Nova 4 Firmware< 10.0.0.160\(c01e32r2p4\)
Huawei Paris-l29b Firmware< 9.1.0.380\(c636e1r1p3t8\)
Huawei Princeton-al10b Firmware< 10.0.0.194\(c00e61r4p11\)
Huawei Sydney-al00 Firmware< 9.1.0.237\(c00e80r1p7t8\)
Huawei Sydneym-al00 Firmware< 10.0.0.159\(c00e64r1p5\)
Huawei Sydney-tl00 Firmware< 9.1.0.237\(c01e80r1p7t8\)
Huawei Tony-al00b Firmware< 10.1.0.137\(c00e137r2p11\)

Remediation

Fixed in
Huawei Berkeley-l09 Firmware≥ 10.0.0.177\(c10e3r1p4\)
Huawei Columbia-al10b Firmware≥ 10.0.0.178\(c00e178r1p4\)
Huawei Columbia-l29d Firmware≥ 10.0.0.177\(c10e4r1p4\)
Huawei Columbia-tl00b Firmware≥ 10.0.0.178\(c01e178r1p4\)
Huawei Columbia-tl00d Firmware≥ 10.0.0.178\(c01e178r1p4\)
Huawei Cornell-al00a Firmware≥ 9.1.0.340\(c00e333r1p1t8\)
Huawei Cornell-tl10b Firmware≥ 9.1.0.340\(c01e333r1p1t8\)
Huawei Dura-al00a Firmware≥ 1.0.0.190\(c00\)
Huawei Honor 20 Pro Firmware≥ 10.0.0.194\(c636e3r3p1\)
Huawei Honor 8a Firmware≥ 9.1.0.291\(c185e3r4p1\)

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1078158.5
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until…
CVE-2026-195708.8
The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies…
CVE-2026-1079099.1
A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the…
CVE-2026-1079089.8
A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c)…
CVE-2026-823448.1
IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow…
CVE-2026-823358.1
IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer…

Frequently asked

Is CVE-2020-0069 being actively exploited?

Yes. CVE-2020-0069 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021.

How severe is CVE-2020-0069?

CVE-2020-0069 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 1.37% probability of exploitation.

Which products are affected by CVE-2020-0069?

Affected products include Google Android, Huawei Berkeley-l09 Firmware, Huawei Columbia-al10b Firmware, Huawei Columbia-l29d Firmware, Huawei Columbia-tl00b Firmware, and 19 more.

How do I fix CVE-2020-0069?

Upgrade affected software to a fixed version, for example Huawei Berkeley-l09 Firmware 10.0.0.177\(c10e3r1p4\), Huawei Columbia-al10b Firmware 10.0.0.178\(c00e178r1p4\), Huawei Columbia-l29d Firmware 10.0.0.177\(c10e4r1p4\) or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2020-0069 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.