CVE-2017-5626
CriticalSummary
OxygenOS before version 4.0.2 on OnePlus 3 and 3T has two hidden fastboot oem commands that allow an attacker to lock/unlock the bootloader without user confirmation. This allows for persistent code execution with high privileges and complete access to user data.
Risk Assessment
An attacker can gain full access to user data and the ability to introduce malicious software, posing a serious threat to the security of devices and personal information.
Recommendation
It is recommended to update the system to version 4.0.2 or later to eliminate this vulnerability and implement additional security measures to protect user data.
Other vulnerabilities in OxygenOS
See all- CVE-2017-5624Critical
An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T that allows an attacker to persistently make the (locked) bootloader start with dm-verity disabled. This results in the kernel not verifying the system partition, potentially allowing for persistent code execution and privilege escalation.
- CVE-2026-70387High
On OnePlus OxygenOS for Android, the olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string; the only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in those domains (including dumpstate, reachable from an unprivileged app) obtains arbitrary command execution, with the spawned shell landing in the u:r:vendor_qti_init_shell:s0 SELinux context holding all Linux capabilities.
Original NVD description (English source)
OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands (4F500301 and 4F500302) that allow the attacker to lock/unlock the bootloader, disregarding the 'OEM Unlocking' checkbox, without user confirmation and without a factory reset. This allows for persistent code execution with high privileges (kernel/root) with complete access to user data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS