Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands (4F500301 and 4F500302) that allow the attacker to lock/unlock the bootloader, disregarding the 'OEM Unlocking' checkbox, without user confirmation and without a factory reset. This allows for persistent code execution with high privileges (kernel/root) with complete access to user data.
AnalysisAI
OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands (4F500301 and 4F500302) that allow the attacker to lock/unlock the bootloader, disregarding the 'OEM. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands (4F500301 and 4F500302) that allow the attacker to lock/unlock the bootloader, disregarding the 'OEM Unlocking' checkbox, without user confirmation and without a factory reset. This allows for persistent code execution with high privileges (kernel/root) with complete access to user data. Affected products include: Oneplus Oxygenos. Version information: version 4.0.2.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. Rated critical severity (CVSS 9.8), this vulnerab
An issue was discovered on OnePlus devices such as the 3T. Rated high severity (CVSS 7.5), this vulnerability is remotel
An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. Rated medium severity (CVSS 6.6), this vul
An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Rated medium severity (CVSS 5.9), this vulnerability is
An issue was discovered on OnePlus One and X devices. Rated medium severity (CVSS 5.9), this vulnerability is remotely e
An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Rated medium severity (CVSS 5.9), this vulnerability is
An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. Rated high severity (CVSS 8.1), this vulnera
With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts wit
In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader to partiall
Share
External POC / Exploit Code
Leaving vuln.today