An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2.
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which could be done without any authentication. A physical attacker can press the "Volume Up" button during device boot, where an attacker with ADB access can issue the adb reboot bootloader command. Then, the attacker can put the platform's SELinux in permissive mode, which severely weakens it, by issuing: fastboot oem selinux permissive.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:oneplus:oxygenos:*:*:*:*:*:*:*:* | up to 3.2.8 | Vulnerable | OnePlus |
| cpe:2.3:h:oneplus:oneplus_3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | OnePlus |
| cpe:2.3:o:oneplus:oxygenos:*:*:*:*:*:*:*:* | up to 3.5.4 | Vulnerable | OnePlus |
| cpe:2.3:h:oneplus:oneplus_3t:-:*:*:*:*:*:*:* | not specified by NVD | Running on | OnePlus |
- cpe:2.3:o:oneplus:oxygenos:*:*:*:*:*:*:*:* Versions up to 3.2.8 Vulnerable ·OnePlus
- cpe:2.3:h:oneplus:oneplus_3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·OnePlus
- cpe:2.3:o:oneplus:oxygenos:*:*:*:*:*:*:*:* Versions up to 3.5.4 Vulnerable ·OnePlus
- cpe:2.3:h:oneplus:oneplus_3t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·OnePlus
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-5554
- 2026-10-03 Alias added: GHSA-qgrw-j67r-q423
References
More OnePlus Oxygenos vulnerabilities
- TI-2017-03628 OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands… CVSS 3.0CRITICAL 9.8
- TI-2017-03626 An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. CVSS 3.0CRITICAL 9.8
- TI-2016-08421 An issue was discovered on OnePlus devices such as the 3T. CVSS 3.0HIGH 7.5
- TI-2017-03865 An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and… CVSS 3.1MEDIUM 6.8
- TI-2017-03625 An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. CVSS 3.0MEDIUM 6.6
- TI-2017-03866 An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. CVSS 3.0MEDIUM 5.9
Sources
- CVE-2017-5554 · CVE Program
- CVE-2017-5554 · NVD
- FIRST EPSS
- GHSA-qgrw-j67r-q423 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences