« Volver al listado

CVE-2017-5623

Estado: ModificadaMedia (6.6)—

An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of the device by issuing the 'fastboot oem boot_mode {rf/wlan/ftm/normal} command' in contradiction to the threat model of Android where the bootloader MUST NOT allow any security-sensitive operation to be run unless the bootloader is unlocked.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Oneplus — Oxygenos

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-5623",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.6,
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.7
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-03-19T20:59:00.170",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/97048",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://alephsecurity.com/vulns/aleph-2017005",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/97048",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://alephsecurity.com/vulns/aleph-2017005",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of the device by issuing the 'fastboot oem boot_mode {rf/wlan/ftm/normal} command' in contradiction to the threat model of Android where the bootloader MUST NOT allow any security-sensitive operation to be run unless the bootloader is unlocked."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en OxygenOS en versiones anteriores a 4.1.0 en dispositivos OnePlus 3 y 3T. El atacante puede cambiar el modo de arranque del dispositivo emitiendo el comando 'bootboom oem boot_mode {rf/wlan/ftm/normal}' en contradicción con el modelo de amenaza de Android donde el gestor de arranque NO DEBE permitir que se ejecute ninguna operación sensible a la seguridad a menos que el gestor de arranque está desbloqueado."
    }
  ],
  "lastModified": "2026-06-17T01:20:52.187",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:oneplus:oxygenos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "399C6C05-D27E-4257-B97C-B036F3D10298",
              "versionEndIncluding": "4.0.3"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:oneplus:oneplus_3:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E6B1891E-38B0-42C5-89D3-3DC12217F087"
            },
            {
              "criteria": "cpe:2.3:h:oneplus:oneplus_3t:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "4C7E02CB-9EAC-4BFD-8CCC-337610E1CCEE"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}