Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2017-8850

Quick assessment

Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OnePlus One等都是中国一加科技（OnePlus）公司的智能手机。OxygenOS和HydrogenOS都是其自带的操作系统。HydrogenOS OTAs是HydrogenOS中的一个系统更新应用程序。 多款OnePlus产品中的OxygenOS和HydrogenOS OTAs存在安全漏洞。攻击者可利用该漏洞重启手机到恢复模式，使用adb sideload来推送OTA。以下产品受到影响：OnePlus One；OnePlus X；OnePlus 2；OnePlus 3；OnePlus 3T。

AI Predicted 7.5 Difficulty: Moderate EPSS 0.43% · P37
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2017-8850

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlus OTA images, and the fact that both ROMs use the same OTA verification keys, attackers can install HydrogenOS over OxygenOS and vice versa, even on locked bootloaders, which allows for exploitation of vulnerabilities patched on one image but not on the other, in addition to expansion of the attack surface. This vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, physical attackers can reboot the phone into recovery, and then use 'adb sideload' to push the OTA (on OnePlus 3/3T 'Secure Start-up' must be off).
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
多款OnePlus产品OxygenOS和HydrogenOS OTAs 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OnePlus One等都是中国一加科技（OnePlus）公司的智能手机。OxygenOS和HydrogenOS都是其自带的操作系统。HydrogenOS OTAs是HydrogenOS中的一个系统更新应用程序。 多款OnePlus产品中的OxygenOS和HydrogenOS OTAs存在安全漏洞。攻击者可利用该漏洞重启手机到恢复模式，使用adb sideload来推送OTA。以下产品受到影响：OnePlus One；OnePlus X；OnePlus 2；OnePlus 3；OnePlus 3T。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2017-8850

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2017-8850

请登录查看更多情报信息。

Other References for CVE-2017-8850 (1)

Same Patch Batch · n/a · 2017-05-11 · 16 CVEs total

CVE-2017-8798 MiniUPnP MiniUPnPc 安全漏洞
CVE-2017-6867 多款Siemens产品输入验证漏洞
CVE-2015-5436 HPE Integrated Lights-Out 4 安全漏洞
CVE-2016-2126 Samba 安全漏洞
CVE-2017-8897 Invision Power Services Community Suite IPS UTF8 Converter 跨站脚本漏洞
CVE-2017-8898 Invision Power Services Community Suite 跨站脚本漏洞
CVE-2017-8899 Invision Power Services Community Suite 跨站脚本漏洞
CVE-2016-10370 多款OnePlus产品安全漏洞
CVE-2017-5948 多款OnePlus产品OxygenOS和HydrogenOS OTAs 安全漏洞
CVE-2017-8851 OnePlus One和X设备安全漏洞
CVE-2017-7472 Linux kernel 资源管理错误漏洞
CVE-2017-8903 Xen 安全漏洞
CVE-2017-8904 Xen 安全漏洞
CVE-2017-8905 Xen 安全漏洞
CVE-2017-8906 MulticoreWare x265 数字错误漏洞

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a