Priority HIGH 72
Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android.
CVSS 4.0HIGH 8.5· Local · Low privileges · No interaction · EPSS 0.01379 · Published 2026-10-21 · Fixed in 16.0.5.1200, 15.0.0.2000 CWE-78
Priority HIGH 69
The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permission, user interaction, or consent.
CVSS 4.0HIGH 8.2· Local · No auth · User interaction · EPSS 0.05083 · Published 2025-09-23 · No fix listed CWE-862
Priority MEDIUM 47
OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands (4F500301 and 4F500302) that allow the attacker to lock/unlock the bootloader, disregarding the 'OEM Unlocking' checkbox, without u…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0282 · Published 2017-03-12 · No fix listed
Priority MEDIUM 47
An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02673 · Published 2017-03-12 · No fix listed CWE-269
Priority MEDIUM 45
The OnePlus 2 Primary Bootloader (PBL) does not validate the SBL1 partition before executing it, although it contains a certificate.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01609 · Published 2017-08-03 · No fix listed
Priority MEDIUM 43
A remote code execution vulnerability in the webview component of OnePlus Store app.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00755 · Published 2023-08-10 · No fix listed
Priority MEDIUM 41
An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2.
CVSS 3.0HIGH 8.1· Network · No auth · No interaction · EPSS 0.02972 · Published 2017-01-23 · No fix listed CWE-287
Priority LOW 38
Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android.
CVSS 4.0HIGH 8.4· Local · High privileges · No interaction · EPSS 0.00308 · Published 2026-10-21 · Fixed in 16.0.5.1200, 15.0.0.2000 CWE-749
Priority LOW 35
An issue was discovered on OnePlus devices such as the 3T.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01146 · Published 2017-05-11 · No fix listed CWE-284
Priority LOW 30
An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier.
CVSS 3.1MEDIUM 6.8· Physical · No auth · No interaction · EPSS 0.00344 · Published 2018-03-29 · No fix listed
Priority LOW 29
An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices.
CVSS 3.0MEDIUM 6.6· Physical · Low privileges · No interaction · EPSS 0.00374 · Published 2017-03-19 · No fix listed CWE-269
Priority LOW 28
An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA.
CVSS 3.1MEDIUM 6.0· Local · High privileges · No interaction · EPSS 0.00581 · Published 2020-04-14 · No fix listed
Priority LOW 28
An issue was discovered on OnePlus One, X, 2, 3, and 3T devices.
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.0076 · Published 2017-05-11 · No fix listed CWE-20
Priority LOW 27
An issue was discovered on OnePlus One and X devices.
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00453 · Published 2017-05-11 · No fix listed CWE-319
Priority LOW 27
An issue was discovered on OnePlus One, X, 2, 3, and 3T devices.
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.0043 · Published 2017-05-11 · No fix listed CWE-319
Priority LOW 26
With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled.
CVSS 3.0MEDIUM 5.9· Physical · Low privileges · No interaction · EPSS 0.00306 · Published 2017-03-26 · No fix listed CWE-276
Priority LOW 21
OnePlus App Locker through 2020-10-06 allows physically proximate attackers to use Google Assistant to bypass an authorization check in order to send an SMS message when the SMS application is locked.
CVSS 3.1MEDIUM 4.6· Physical · No auth · No interaction · EPSS 0.00315 · Published 2020-10-09 · No fix listed CWE-862
Priority LOW 21
In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader to partially dump the ciphertext content of an arbitrary partition (except 'keystore') by issuing the 'fastboot…
CVSS 3.0MEDIUM 4.6· Physical · No auth · No interaction · EPSS 0.00332 · Published 2017-04-25 · No fix listed CWE-476
THREATIST.IORead the docs