CVE-2017-5626 OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands (4F500301 and 4F500302) that allow the attacker to lock/unlock the bootloader, disregarding the 'OEM Unlocking'...
CriticalCVSS 9.8
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands (4F500301 and 4F500302) that allow the attacker to lock/unlock the bootloader, disregarding the 'OEM Unlocking' checkbox, without user confirmation and without a factory reset. This allows for persistent code execution with high privileges (kernel/root) with complete access to user data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| OnePlus OxygenOS | <= 3.2.8 | No fix listed |
| OnePlus OxygenOS | <= 3.5.4 | No fix listed |
References
- securityresear.ch exploit technical-description third-party-advisory