CVE-2020-9531

Description

An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. In the Web resources of GetApps(com.xiaomi.mipicks), the parameters passed in are read and executed. After reading the resource files, relevant components open the link of the incoming URL. Although the URL is safe and can pass security detection, the data carried in the parameters are loaded and executed. An attacker can use NFC tools to get close enough to a user's unlocked phone to cause apps to be installed and information to be leaked. This is fixed on version: 2001122.

7.3

CVSS

Severity: High

CVSS 3.1 •

CVSS 2.0 •

EPSS 0.21%

Vendor Advisory xiaomi.com

Affected: n/a n/a

References

Link	Tags
https://sec.xiaomi.com/post/180	vendor advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-287/	vdb entry third party advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-288/	vdb entry third party advisory

Frequently Asked Questions

What is the severity of CVE-2020-9531?: CVE-2020-9531 has been scored as a high severity vulnerability.
How to fix CVE-2020-9531?: To fix CVE-2020-9531, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2020-9531 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2020-9531 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.