CVE-2017-5622 With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled. Therefore, a malicious charger or a physical attacker can open u...
MediumCVSS 5.9
EPSS 0.31%
- Published
- Updated
- Exploit status
- No public exploit known
Description
With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled. Therefore, a malicious charger or a physical attacker can open up, without authorization, an ADB session with the device, in order to further exploit other vulnerabilities and/or exfiltrate sensitive information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| OnePlus OxygenOS | <= 4.0.2 | No fix listed |
References
- 97092 vdb-entry
- alephsecurity.com technical-description third-party-advisory