CVE-2023-26309
Published Aug 10, 2023A remote code execution vulnerability in the webview component of OnePlus Store app.
Vendor archive
oneplus CVEs
Beta · best-effort15 CVEs tagged to vendor oneplus — 3 Critical, 3 High, 9 Medium, 0 Low, 0 Unrated.
CVE-2020-13626
Published Oct 9, 2020OnePlus App Locker through 2020-10-06 allows physically proximate attackers to use Google Assistant to bypass an authorization check in order to send an SMS message when the SMS a…
CVE-2020-7958
Published Apr 14, 2020An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privileged user (root) in the Rich Execution E…
CVE-2017-5947
Published Mar 29, 2018An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier. The attacker can reboot the device into the Qualcomm Emergency Download (EDL) mod…
CVE-2017-11105
Published Aug 3, 2017The OnePlus 2 Primary Bootloader (PBL) does not validate the SBL1 partition before executing it, although it contains a certificate. This allows attackers with write access to tha…
CVE-2017-8851
Published May 11, 2017An issue was discovered on OnePlus One and X devices. Due to a lenient updater-script on the OnePlus One and X OTA images, the fact that both products use the same OTA verificatio…
CVE-2017-8850
Published May 11, 2017An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlus OTA images, and the fact that both ROMs use the same OTA verificati…
CVE-2017-5948
Published May 11, 2017An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to downgrade attacks. This is due to a lenient 'updater-script' in OTAs tha…
CVE-2016-10370
Published May 11, 2017An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of a…
CVE-2017-5625
Published Apr 25, 2017In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader to partially dump the ciphertext content of an arbitrary partition (ex…
CVE-2017-5622
Published Mar 26, 2017With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled. Therefore, a malicious charger or a physica…
CVE-2017-5623
Published Mar 19, 2017An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of the device by issuing the 'fastboot oem boot_mode {rf/wlan/ft…
CVE-2017-5626
Published Mar 12, 2017OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands (4F500301 and 4F500302) that allow the attacker to lock/unlock the bootloader, disregardin…
CVE-2017-5624
Published Mar 12, 2017An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the (locked) bootloader start the platform with dm-verity disabled, by is…
CVE-2017-5554
Published Jan 23, 2017An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which could be done without any authenticati…
Showing 1-15 of 15 CVEsPage 1 of 1