2 lines
4.4 KiB
JSON
2 lines
4.4 KiB
JSON
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:oneplus:oxygenos:*:*:*:*:*:*:*:*","matchCriteriaId":"8189780A-EA20-4B96-A625-48D12948B3F2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:oneplus:oneplus_2:-:*:*:*:*:*:*:*","matchCriteriaId":"332B048C-6522-41A7-9DAB-834FBFCA3C00","vulnerable":false},{"criteria":"cpe:2.3:h:oneplus:oneplus_3:-:*:*:*:*:*:*:*","matchCriteriaId":"E6B1891E-38B0-42C5-89D3-3DC12217F087","vulnerable":false},{"criteria":"cpe:2.3:h:oneplus:oneplus_3t:-:*:*:*:*:*:*:*","matchCriteriaId":"4C7E02CB-9EAC-4BFD-8CCC-337610E1CCEE","vulnerable":false},{"criteria":"cpe:2.3:h:oneplus:oneplus_one:-:*:*:*:*:*:*:*","matchCriteriaId":"8B8AD37A-7539-4F16-8AC2-2556035B0DE2","vulnerable":false},{"criteria":"cpe:2.3:h:oneplus:oneplus_x:-:*:*:*:*:*:*:*","matchCriteriaId":"C0A390FA-9B56-4645-991D-5E9CB16966B9","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to downgrade attacks. This is due to a lenient 'updater-script' in OTAs that does not check that the current version is lower than or equal to the given image's. Downgrades can occur even on locked bootloaders and without triggering a factory reset, allowing for exploitation of now-patched vulnerabilities with access to user data. This vulnerability can be exploited by a Man-in-the-Middle (MiTM) attacker targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, a physical attacker can reboot the phone into recovery, and then use 'adb sideload' to push the OTA (on OnePlus 3/3T 'Secure Start-up' must be off)."},{"lang":"es","value":"Se detectó un problema en los dispositivos OnePlus versiones One, X, 2, 3 y 3T. OxygenOS e HydrogenOS son vulnerables a ataques de degradación. Esto se debe a un \"updater-script\" indulgente en OTAs que no comprueba que la versión actual sea inferior o igual a la de la imagen en cuestión. Las degradaciones pueden ocurrir incluso en cargadores de arranque bloqueados y sin activar un restablecimiento de fábrica, permitiendo la explotación de las vulnerabilidades ahora parcheadas con acceso a los datos del usuario. Esta vulnerabilidad puede ser explotada por un atacante de tipo Man-in-the-Middle (MiTM) que se dirija al proceso de actualización. Esto es posible porque la transacción de actualización no se realiza por medio de TLS (CVE-2016-10370). Adicionalmente, un atacante físico puede reiniciar el teléfono en la recuperación y luego usar \"adb sideload\" para empujar la OTA (en OnePlus 3/3T \"Secure Start-up\" debe estar desactivado)."}],"id":"CVE-2017-5948","lastModified":"2026-06-17T01:21:29.620","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":4.3,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":8.6,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.0"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2017-05-11T18:29:00.220","references":[{"source":"cve@mitre.org","tags":["Exploit","Technical Description","Third Party Advisory"],"url":"https://alephsecurity.com/vulns/aleph-2017008"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Technical Description","Third Party Advisory"],"url":"https://alephsecurity.com/vulns/aleph-2017008"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"nvd@nist.gov","type":"Primary"}]}
|