Design/Logic Flaw

An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to downgrade attacks. This is due to a lenient 'updater-script' in OTAs that does not check that the current version is lower than or equal to the given image's. Downgrades can occur even on...

CVE-2017-5948

CVE-2017-5948 is a downgrade-attack vulnerability in OnePlus OxygenOS and HydrogenOS OTA updates. The root cause is a lenient updater-script in OTAs for OnePlus One, X, 2, 3, and 3T that does not enforce that the current version is

CVE-2017-8850: Cleartext Transmission of Sensitive Information

An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlus OTA images, and the fact that both ROMs use the same OTA verification keys, attackers can install HydrogenOS over OxygenOS and vice versa, even on locked bootloaders, which allows for...

CVE-2017-8851: Cleartext Transmission of Sensitive Information

An issue was discovered on OnePlus One and X devices. Due to a lenient updater-script on the OnePlus One and X OTA images, the fact that both products use the same OTA verification keys, and the fact that both products share the same 'ro.build.product' system property, attackers can install OTAs ...

PT-2017-18581

Name of the Vulnerable Software and Affected Versions OnePlus One versions affected versions not specified OnePlus X versions affected versions not specified Description An issue allows attackers to install OTAs of one product over the other, even on locked bootloaders, due to a lenient...

PT-2017-18580

Name of the Vulnerable Software and Affected Versions OnePlus One version affected versions not specified OnePlus X version affected versions not specified OnePlus 2 version affected versions not specified OnePlus 3 version affected versions not specified OnePlus 3T version affected versions not...

CVE-2017-5948: Improper Input Validation

An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to downgrade attacks. This is due to a lenient 'updater-script' in OTAs that does not check that the current version is lower than or equal to the given image's. Downgrades can occur even on...