Vulnerability in OnePlus Devices Allowing Unauthorized OTA Updates

CVE-2017-8851

What is CVE-2017-8851?

A critical security issue exists in OnePlus devices, specifically the OnePlus One and OnePlus X, that allows unauthorized Over-The-Air (OTA) updates due to improperly configured update scripts. Both devices rely on identical OTA verification keys and share the same system property, leading to potential exploitation. Attackers can install OTA updates of one device on another, even if the bootloader is locked. This vulnerability increases the risk of performing updates that might not have been patched on one device while the other has been secured. Moreover, it can render the device inoperable until a Factory Reset is performed. The exploitation can be executed by Man-in-the-Middle (MiTM) attackers targeting the unprotected update process. Additionally, physical access to the device enables attackers to reboot it into recovery mode, allowing the use of 'adb sideload' for deploying malicious OTAs.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References