EUVD-2017-15017

Malware in sbrugna...

EUVD-2017-17793

Malware in sbrugna...

EUVD-2017-14719

Malware in sbrugna...

EUVD-2017-17792

Malware in sbrugna...

EUVD-2016-1552

Malware in sbrugna...

EUVD-2017-15018

Malware in sbrugna...

CVE-2017-5947

An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier. The attacker can reboot the device into the Qualcomm Emergency Download EDL mode through ADB or by using Volume-Up when connected to USB, which in turn could allow for downgrading partitions such as...

Security Bypass Vulnerability in Multiple OnePlus Devices

The OnePlus One, among others, are smartphones from China's OnePlus Technology OnePlus.OxygenOS and HydrogenOS are its own operating systems. A security bypass vulnerability exists in multiple OnePlus devices. An attacker can exploit the vulnerability to launch further attacks by performing a...

Unspecified Vulnerability in OxygenOS and HydrogenOS OTAs for Multiple OnePlus Products

OnePlus One and others are smartphones from China's OnePlus Technology OnePlus.OxygenOS and HydrogenOS are both operating systems that come with them.HydrogenOS OTAs is a system update application in HydrogenOS. A security vulnerability exists in OxygenOS and HydrogenOS OTAs in multiple OnePlus...

Design/Logic Flaw

An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs due to the digital signature, it unnecessarily increases the attack surface, and allows for remote...

Code injection

An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlus OTA images, and the fact that both ROMs use the same OTA verification keys, attackers can install HydrogenOS over OxygenOS and vice versa, even on locked bootloaders, which allows for...

CVE-2017-5554

An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which could be done without any authentication. A physical attacker can press the "Volume Up" button during device boot, where an attacker with ADB access can iss...