CVE-2017-5948

CVE-2017-5948 is a downgrade-attack vulnerability in OnePlus OxygenOS and HydrogenOS OTA updates. The root cause is a lenient updater-script in OTAs for OnePlus One, X, 2, 3, and 3T that does not enforce that the current version is

CVE-2016-10370

An issue linked to CVE-2016-10370 affects OnePlus OTA updaters on devices such as OnePlus 3/3T: the OTA image is delivered over HTTP without TLS, increasing the attack surface and enabling potential exploitation of other vulnerabilities (CVE-2017-5948, CVE-2017-8850, CVE-2017-8851). The root caus...

CVE-2017-8850

CVE-2017-8850 covers OnePlus OTA downgrade/crossover vulnerabilities caused by lenient updater-scripts and shared OTA keys across OxygenOS and HydrogenOS, enabling cross-flash of OTAs and MiTM abuse of the update channel. The issue affects OnePlus devices including OnePlus One, X, 2, 3, and 3T, w...

CVE-2017-8851

CVE-2017-8851 affects OnePlus One and OnePlus X. A lenient updater-script, shared OTA verification keys, and identical ro.build.product allow cross-flashing of OTAs between products, even with locked bootloaders. This enables MiTM targets of the update process and, since updates are not over TLS ...