Is CVE-2020-7958 actively exploited?

No active exploitation of CVE-2020-7958 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2020-7958 be exploited remotely?

No. CVE-2020-7958 requires local access to exploit.

What is the CVSS score of CVE-2020-7958?

CVE-2020-7958 has a CVSS score of 6.0 (MEDIUM).

HOME VULNERABILITIESCVE-2020-7958

MEDIUM

CVE-2020-7958

NVD-CWE-noinfoPublished: April 14, 2020· Updated: Jun 17, 2026

6.0

CVSS v3.1

Official Description

An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privileged user (root) in the Rich Execution Environment (REE) to obtain bitmap images from the fingerprint sensor because of Leftover Debug Code. The issue is that the Trusted Application (TA) supports an extended number of commands beyond what is needed to implement a fingerprint authentication system compatible with Android. An attacker who is in the position to send commands to the TA (for example, the root user) is able to send a sequence of these commands that will result in the TA sending a raw fingerprint image to the REE. This means that the Trusted Execution Environment (TEE) no longer protects identifiable fingerprint data from the REE.

NVD Source

Technical Analysis

CVE-2020-7958 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.0.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.