PT-2017-16627 · Oneplus · Oxygenos

Roee Hay + 1 · Published 2017-03-19 · Updated 2019-10-03 · CVE-2017-5623

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OxygenOS versions prior to 4.1.0

Description An issue was discovered that allows an attacker to change the boot mode of the device by issuing a specific command, contradicting the Android threat model where the bootloader should not allow security-sensitive operations unless it is unlocked.

Recommendations For OxygenOS versions prior to 4.1.0, update to version 4.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the fastboot command to minimize the risk of exploitation. Avoid using the fastboot oem boot mode command with parameters such as {rf/wlan/ftm/normal} until the issue is resolved.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2017-5623

Affected Products

Oxygenos

References · 4

• 🔥 https://alephsecurity.com/vulns/aleph-2017005 · Exploit
• https://osv.dev/vulnerability/CVE-2017-5623 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5623 · Security Note
• http://securityfocus.com/bid/97048 · Note