CVE-2017-5622

low-risk
Published 2017-03-26

With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled. Therefore, a malicious charger or a physical attacker can open up, without authorization, an ADB session with the device, in order to further exploit other vulnerabilities and/or exfiltrate sensitive information.

Do I need to act?

-
0.06% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.9/10 Medium
PHYSICAL / LOW complexity

Affected Products (1)

Oxygenos

Affected Vendors

Oneplus

References (4)

http://www.securityfocus.com/bid/97092
Technical Description https://alephsecurity.com/vulns/aleph-2017004
http://www.securityfocus.com/bid/97092
Technical Description https://alephsecurity.com/vulns/aleph-2017004
24
/ 100
low-risk
Severity 19/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal