PT-2017-16627 · Oneplus · Oxygenos

Roee Hay + 1 · Publicado 2017-03-19 · Atualizado 2019-10-03 · CVE-2017-5623

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OxygenOS versions prior to 4.1.0

Description An issue was discovered that allows an attacker to change the boot mode of the device by issuing a specific command, contradicting the Android threat model where the bootloader should not allow security-sensitive operations unless it is unlocked.

Recommendations For OxygenOS versions prior to 4.1.0, update to version 4.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the fastboot command to minimize the risk of exploitation. Avoid using the fastboot oem boot mode command with parameters such as {rf/wlan/ftm/normal} until the issue is resolved.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2017-5623

Produtos afetados

Oxygenos

Referências · 4

• 🔥 https://alephsecurity.com/vulns/aleph-2017005 · Exploit
• https://osv.dev/vulnerability/CVE-2017-5623 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-5623 · Nota de Segurança
• http://securityfocus.com/bid/97048 · Nota