CVE-2017-5948

An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to downgrade attacks. This is due to a lenient 'updater-script' in OTAs that does not check that the current version is lower than or equal to the given image's. Downgrades can occur even on locked bootloaders and without triggering a factory reset, allowing for exploitation of now-patched vulnerabilities with access to user data. This vulnerability can be exploited by a Man-in-the-Middle (MiTM) attacker targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, a physical attacker can reboot the phone into recovery, and then use 'adb sideload' to push the OTA (on OnePlus 3/3T 'Secure Start-up' must be off).

• CWE-20

• https://alephsecurity.com/vulns/aleph-2017008Exploit, Technical Description, Third Party Advisory
• https://alephsecurity.com/vulns/aleph-2017008Exploit, Technical Description, Third Party Advisory

Published

May 11, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5942An issue was discovered in the WP Mail plugin before 1.2 for…6.1
• CVE-2017-5943Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14,…
• CVE-2017-5944The dashboard subscription interface in Request Tracker (RT)…
• CVE-2017-5945An issue was discovered in the PoodLL Filter plugin through …
• CVE-2017-5946The Zip::File component in the rubyzip gem before 1.2.1 for …9.8
• CVE-2017-5947An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 d…6.8
• CVE-2017-5949JavaScriptCore in WebKit, as distributed in Safari Technolog…
• CVE-2017-5950The SingleDocParser::HandleNode function in yaml-cpp (aka Li…
• CVE-2017-5951The mem_get_bits_rectangle function in base/gdevmem.c in Art…
• CVE-2017-5953vim before patch 8.0.0322 does not properly validate values …
• CVE-2017-5954An issue was discovered in the serialize-to-js package 0.5.0…
• CVE-2017-5956The vrend_draw_vbo function in virglrenderer before 0.6.0 al…