CVE-2017-5626

OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands (4F500301 and 4F500302) that allow the attacker to lock/unlock the…

published March 12, 2017

CVSS
—
EPSS
3%
Percentile
86.5
In the wild
Unconfirmed
What it is

🚨 A pair of sneaky fastboot commands can unlock the bootloader without a peep from you! This is a real blindside for OnePlus 3 and 3T users. 🔥 Think of it like a hotel room key that lets someone enter and change the locks while you’re out — you come back to find your things rearranged, and you have no idea who did it! An attacker could leverage this flaw to gain full control over your device, accessing sensitive data, installing malicious applications, or even locking you out entirely. This isn't just a privacy concern; it can lead to serious data breaches!

Put simply

Think of it like a hotel room key that lets someone enter and change the locks while you’re out — you come back to find your things rearranged, and you have no idea who did it! This vulnerability in OxygenOS allows unauthorized execution of hidden fastboot commands, enabling bootloader manipulation without user consent, effectively bypassing security settings.

What to do

An attacker could leverage this flaw to gain full control over your device, accessing sensitive data, installing malicious applications, or even locking you out entirely. This isn't just a privacy concern; it can lead to serious data breaches! Update your OxygenOS to version 4.0.2 or later immediately. It’s crucial to keep your device firmware current to protect against unauthorized access. Additionally, be vigilant about device permissions and security settings! You've got this! Stay proactive and secure your device. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02820 · 86.5th percentile
Published
2017-03-12T04:57Z
EPSS history
Timeline
  • 12 MAR 04:57Z
    OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands (4F500301 and 4F500302) that allow the attacker to lock/unlock the…
    cvelistv5