CVE-2016-10370

HIGH

OxygenOS - Unauthenticated Signed OTA Image Exposure via HTTP

Title source: llm
STIX 2.1

Description

An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs (due to the digital signature), it unnecessarily increases the attack surface, and allows for remote exploitation of other vulnerabilities such as CVE-2017-5948, CVE-2017-8850, and CVE-2017-8851.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/98495
Exploit, Technical Description, Third Party Advisory x_refsource_misc
https://alephsecurity.com/vulns/aleph-2017022

Scores

CVSS v3 7.5
EPSS 0.0115
EPSS Percentile 62.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-284
Status published
Products (1)
oneplus/oxygenos
Published May 11, 2017
Tracked Since Feb 18, 2026