CVE Feed

    Dashboard / CVE / CVE-2016-10370

    CVE-2016-10370

    An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs (due to the digital signature), it unnecessarily increases the attack surface, and allows for remote exploitation of other vulnerabilities such as CVE-2017-5948, CVE-2017-8850, and CVE-2017-8851.

    Published:May 11, 2017
    Last Modified:Apr 20, 2025
    EPS:May 11, 2017
    EPSS Score:0.0022
    CVSS Score:7.5

    Affected Products

    Vendor
    Oneplus
    Product
    Oneplus 3t
    Vendor
    Oneplus
    Product
    Oxygenos

    Exploits

    https://alephsecurity.com/vulns/aleph-2017022https://alephsecurity.com/vulns/aleph-2017022

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2017-5947 (CVSS 6.8) — An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier. The attacker…
    CVE-2017-8850 (CVSS 5.9) — An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlu…
    CVE-2017-5948 (CVSS 5.9) — An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to dow…
    CVE-2017-5625 (CVSS 4.6) — In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader t…
    CVE-2017-5622 (CVSS 5.9) — With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform …
    CVE-2017-5623 (CVSS 6.6) — An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the boot…
    CVE-2017-5624 (CVSS 9.8) — An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the …
    CVE-2017-5626 (CVSS 9.8) — OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands (4F500301 and 4F50030…
    CVE-2017-5554 (CVSS 8.1) — An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High