Bootloader Vulnerability in OnePlus Devices
CVE-2017-5625

4.6MEDIUM

Key Information:

Vendor

Oneplus

Status
Oxygenos
Vendor
CVE Published:
25 April 2017

What is CVE-2017-5625?

A vulnerability exists in OxygenOS versions prior to 4.0.3 for OnePlus 3 and 3T devices, allowing an unauthorized attacker to exploit the bootloader. By executing the 'fastboot oem dump ' command, an attacker can partially extract ciphertext data from any partition except for 'keystore'. This exposure presents a significant risk by potentially revealing sensitive information and weakening the overall security posture of the device.

References

https://alephsecurity.com/vulns/aleph-2017006
x_refsource_MISC

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.