CVE-2017-8850

An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlus OTA images, and the fact that both ROMs use the same OTA verification keys, attackers can install HydrogenOS over OxygenOS and vice versa, even on locked bootloaders, which allows for exploitation of vulnerabilities patched on one image but not on the other, in addition to expansion of the attack surface. This vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, physical attackers can reboot the phone into recovery, and then use 'adb sideload' to push the OTA (on OnePlus 3/3T 'Secure Start-up' must be off).

• CWE-319

• https://alephsecurity.com/vulns/aleph-2017020Exploit, Issue Tracking, Third Party Advisory
• https://alephsecurity.com/vulns/aleph-2017020Exploit, Issue Tracking, Third Party Advisory

Published

May 11, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-8844The read_1g function in stream.c in liblrzip.so in lrzip 0.6…7.8
• CVE-2017-8845The lzo1x_decompress function in lzo1x_d.ch in LZO 2.08, as …5.5
• CVE-2017-8846The read_stream function in stream.c in liblrzip.so in lrzip…5.5
• CVE-2017-8847The bufRead::get() function in libzpaq/libzpaq.h in liblrzip…5.5
• CVE-2017-8848Allen Disk 1.6 has CSRF in setpass.php with an impact of cha…
• CVE-2017-8849smb4k before 2.0.1 allows local users to gain root privilege…
• CVE-2017-8851An issue was discovered on OnePlus One and X devices. Due to…
• CVE-2017-8852SAP SAPCAR 721.510 has a Heap Based Buffer Overflow Vulnerab…
• CVE-2017-8853Fiyo CMS v2.0.7 has an arbitrary file delete vulnerability i…
• CVE-2017-8854wolfSSL before 3.10.2 has an out-of-bounds memory access wit…
• CVE-2017-8855wolfSSL before 3.11.0 does not prevent wc_DhAgree from accep…
• CVE-2017-8856In Veritas NetBackup 8.0 and earlier and NetBackup Appliance…