CVE-2016-10370

An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs (due to the digital signature), it unnecessarily increases the attack surface, and allows for remote exploitation of other vulnerabilities such as CVE-2017-5948, CVE-2017-8850, and CVE-2017-8851.

• CWE-284

• http://www.securityfocus.com/bid/98495
• https://alephsecurity.com/vulns/aleph-2017022Exploit, Technical Description, Third Party Advisory
• https://forums.oneplus.net/threads/ota-and-imei-over-http.453992/Vendor Advisory
• http://www.securityfocus.com/bid/98495
• https://alephsecurity.com/vulns/aleph-2017022Exploit, Technical Description, Third Party Advisory
• https://forums.oneplus.net/threads/ota-and-imei-over-http.453992/Vendor Advisory

Published

May 11, 2017

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-10365Kibana versions before 4.6.3 and 5.0.1 have an open redirect…
• CVE-2016-10366Kibana versions after and including 4.3 and before 4.6.2 are…
• CVE-2016-10367In Opsview Monitor Pro (Prior to 5.1.0.162300841, prior to 5…
• CVE-2016-10368Open redirect vulnerability in Opsview Monitor Pro (Prior to…
• CVE-2016-10369unixsocket.c in lxterminal through 0.3.0 insecurely uses /tm…
• CVE-2016-1037Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat…
• CVE-2016-10371The TIFFWriteDirectoryTagCheckedRational function in tif_dir…
• CVE-2016-10372The Eir D1000 modem does not properly restrict the TR-064 pr…
• CVE-2016-10373Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-10374perltidy through 20160302, as used by perlcritic, check-all-…5.5
• CVE-2016-10375Yodl before 3.07.01 has a Buffer Over-read in the queue_push…
• CVE-2016-10376Gajim through 0.16.7 unconditionally implements the "XEP-014…