CVE-2016-10370: High severity OnePlus OxygenOS vulnerability
An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs (due to the digital signature), it unnecessarily increases the attack surface, and allows for remote exploitation of other vulnerabilities such as CVE-2017-5948, CVE-2017-8850, and CVE-2017-8851.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10370?
The CVE-2016-10370 vulnerability has a low to medium severity rating due to its reliance on the digital signature of OTAs.
How do I fix CVE-2016-10370?
To fix CVE-2016-10370, it is recommended to update to a version of OxygenOS that uses TLS for OTA updates.
Which devices are affected by CVE-2016-10370?
CVE-2016-10370 primarily affects OnePlus devices running certain versions of OxygenOS, including the OnePlus 3T.
What risks does CVE-2016-10370 pose?
CVE-2016-10370 increases the attack surface as it allows for potential remote exploitation through unencrypted OTA update channels.
Is it safe to use OnePlus devices that are affected by CVE-2016-10370?
While affected devices can still be used safely, it's recommended to apply updates that address the vulnerability as a precaution.