CVE•Published 2017-01-23•Modified 2026-05-13•1 article on news•6 live references•NVD data

CVE-2017-5554Oneplus · Oxygenos

Vulnerability data via NVD (ingested)

CVSS v3.1

8.1

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS percentile

—

Weaknesses (CWE)

CWE-287Improper Authentication

Description

An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which could be done without any authentication. A physical attacker can press the "Volume Up" button during device boot, where an attacker with ADB access can issue the adb reboot bootloader command. Then, the attacker can put the platform's SELinux in permissive mode, which severely weakens it, by issuing: fastboot oem selinux permissive.

Timeline

Published 2017-01-23

Modified 2026-05-13

External references

NVD MITRE Exploit-DB GitHub PoC trickest/cve VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2017-5554

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · OS

os:"Oxygenos"

Hosts Shodan identified as running Oxygenos.

More intel sources (5)

Shodan report

vuln:CVE-2017-5554

Country / ASN / product breakdown for the vuln query.

Censys

vulnerabilities.cve_id: CVE-2017-5554