https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 22:40:01 +0000 https://cve.radiocsirt.org/vuln/cve-2017-5948 <p>An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to downgrade attacks. This is due to a lenient &#39;updater-script&#39; in OTAs that does not check that the current version is lower than or equal to the given image&#39;s. Downgrades can occur even on locked bootloaders and without triggering a factory reset, allowing for exploitation of now-patched vulnerabilities with access to user data. This vulnerability can be exploited by a Man-in-the-Middle (MiTM) attacker targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, a physical attacker can reboot the phone into recovery, and then use &#39;adb sideload&#39; to push the OTA (on OnePlus 3/3T &#39;Secure Start-up&#39; must be off).</p> <p>An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to downgrade attacks. This is due to a lenient &#39;updater-script&#39; in OTAs that does not check that the current version is lower than or equal to the given image&#39;s. Downgrades can occur even on locked bootloaders and without triggering a factory reset, allowing for exploitation of now-patched vulnerabilities with access to user data. This vulnerability can be exploited by a Man-in-the-Middle (MiTM) attacker targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, a physical attacker can reboot the phone into recovery, and then use &#39;adb sideload&#39; to push the OTA (on OnePlus 3/3T &#39;Secure Start-up&#39; must be off).</p> https://cve.radiocsirt.org/vuln/cve-2017-5948