CVE-2017-5626
CriticalSummary
OxygenOS before version 4.0.2 on OnePlus 3 and 3T has two hidden fastboot oem commands that allow an attacker to lock/unlock the bootloader without user confirmation. This allows for persistent code execution with high privileges and complete access to user data.
Risk Assessment
An attacker can gain full access to user data and the ability to introduce malicious software, posing a serious threat to the security of devices and personal information.
Recommendation
It is recommended to update the system to version 4.0.2 or later to eliminate this vulnerability and implement additional security measures to protect user data.
Original NVD description (English source)
OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands (4F500301 and 4F500302) that allow the attacker to lock/unlock the bootloader, disregarding the 'OEM Unlocking' checkbox, without user confirmation and without a factory reset. This allows for persistent code execution with high privileges (kernel/root) with complete access to user data.