PT-2017-16780 · Oneplus · Hydrogenos+5
Roee Hay
·
Published
2017-05-11
·
Updated
2019-10-03
·
CVE-2017-5948
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
OnePlus devices (One, X, 2, 3, and 3T) running OxygenOS and HydrogenOS (affected versions not specified)
Description
The issue allows for downgrade attacks due to a lenient 'updater-script' in OTAs that does not check the current version against the given image's version. This enables downgrades to occur even on locked bootloaders and without triggering a factory reset, potentially exploiting now-patched vulnerabilities and accessing user data. The vulnerability can be exploited by a Man-in-the-Middle (MiTM) attacker targeting the update process, as the update transaction does not occur over TLS. Additionally, a physical attacker can reboot the phone into recovery and use 'adb sideload' to push the OTA, provided 'Secure Start-up' is off on OnePlus 3/3T devices.
Recommendations
For OnePlus One, X, 2, 3, and 3T devices running OxygenOS and HydrogenOS, consider disabling the OTA update feature until a patch is available to prevent potential downgrade attacks.
Restrict physical access to the devices to minimize the risk of exploitation by a physical attacker.
Avoid using public or unsecured networks for updating the devices to reduce the risk of Man-in-the-Middle attacks.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Hydrogenos
Oneplus 2
Oneplus 3
Oneplus One
Oneplus X
Oxygenos