CVE-2017-5625

In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader to partially dump the ciphertext content of an arbitrary partition except 'keystore' by issuing the 'fastboot oem dump ' fastboot command...

CVE-2017-5625

The CVE affects OnePlus 3/3T devices running OxygenOS before 4.0.3. A compromised fastboot interface can allow an unauthorized attacker with physical access and bootloader that is locked to partially dump ciphertext content from arbitrary partitions (excluding keystore) via fastboot oem dump . Th...

PT-2017-16628

Name of the Vulnerable Software and Affected Versions OxygenOS versions prior to 4.0.3 Description The issue allows an unauthorized attacker to partially dump the ciphertext content of an arbitrary partition, except 'keystore', by using the 'fastboot oem dump ' command. This affects OnePlus 3 and...

CVE-2017-5625: NULL Pointer Dereference

In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader to partially dump the ciphertext content of an arbitrary partition except 'keystore' by issuing the 'fastboot oem dump ' fastboot command...

OnePlus 3 and 3T OxygenOS security bypass vulnerability

The OnePlus 3 and 3T are both smartphones from China's OnePlus Technology OnePlus.OxygenOS is the operating system that comes with the device. A security bypass vulnerability exists in OxygenOS in OnePlus 3 and 3T. An attacker can exploit the vulnerability to open an ADB session and disclose...

OnePlus 3/3T open up an ADB session without authorization (CVE-2017-5622)

Last month we published CVE-2017-5626 patched in OxygenOS 4.0.2, a vulnerability which allowed attackers to effectively unlock a OnePlus 3/3T device without a factory reset. Combining this with our also discovered CVE-2017-5624 patched in OxygenOS 4.0.3 enabled a powerful attack against locked...

CVE-2017-5622

With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled. Therefore, a malicious charger or a physical attacker can open up, without authorization, an ADB session with the device, in order to further exploit other...

Authorization

With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled. Therefore, a malicious charger or a physical attacker can open up, without authorization, an ADB session with the device, in order to further exploit other...

CVE-2017-5622

With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled. Therefore, a malicious charger or a physical attacker can open up, without authorization, an ADB session with the device, in order to further exploit other...

CVE-2017-5622

CVE-2017-5622 (OnePlus 3/3T, OxygenOS prior to 4.0.3) describes a vulnerability where a charger connected to a powered‑off device enables adbd, allowing an attacker to open an ADB session without user authorization. The linked sources explain that OnePlus customized adbd to bypass ADB authorizati...

PT-2017-16626

Name of the Vulnerable Software and Affected Versions OnePlus 3 and 3T versions prior to 4.0.3 Description The issue allows a malicious charger or a physical attacker to open an ADB session with the device without authorization when a charger is connected to a powered-off device. This can be used...

CVE-2017-5622: Incorrect Default Permissions

With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled. Therefore, a malicious charger or a physical attacker can open up, without authorization, an ADB session with the device, in order to further exploit other...

OnePlus OxygenOS Local Security Bypass Vulnerability

The OnePlus 3 and 3T are both smartphones from China's OnePlus Technology OnePlus.OxygenOS is the operating system it comes with. A local security bypass vulnerability exists in OnePlus OxygenOS. An attacker can exploit the vulnerability to bypass security restrictions and perform unauthorized...

OnePlus 3/3T OxygenOS Unauthorized Boot Mode Changing (CVE-2017-5623)

Summary A physical attacker or one with authorized-ADB access, e.g. PC malware can change the ‘boot mode’ of a locked OnePlus 3/3T device, by rebooting into fastboot and issuing the fastboot oem bootmode rf/wlan/ftm/normal command. The vulnerability may allow the attacker to elevate his privilege...

CVE-2017-5623

An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of the device by issuing the 'fastboot oem bootmode rf/wlan/ftm/normal command' in contradiction to the threat model of Android where the bootloader MUST NOT allow any...

CVE-2017-5623

An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of the device by issuing the 'fastboot oem bootmode rf/wlan/ftm/normal command' in contradiction to the threat model of Android where the bootloader MUST NOT allow any...

Command injection

An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of the device by issuing the 'fastboot oem bootmode rf/wlan/ftm/normal command' in contradiction to the threat model of Android where the bootloader MUST NOT allow any...

CVE-2017-5623

Technical details specific to CVE-2017-5623 are not provided in the connected documents. The materials discuss related CVEs and general context. Monitor for updates.

CVE-2017-5623

An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of the device by issuing the 'fastboot oem bootmode rf/wlan/ftm/normal command' in contradiction to the threat model of Android where the bootloader MUST NOT allow any...

CVE-2017-5623: Improper Privilege Management

An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of the device by issuing the 'fastboot oem bootmode rf/wlan/ftm/normal command' in contradiction to the threat model of Android where the bootloader MUST NOT allow any...