NVD

Id
86430  
Name
CVE-2016-10370  
Description
An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs (due to the digital signature), it unnecessarily increases the attack surface, and allows for remote exploitation of other vulnerabilities such as CVE-2017-5948, CVE-2017-8850, and CVE-2017-8851.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)  
Pub Date
2017-05-27  
Published
2017-05-11  
Modified Date
2017-05-22  
Seq
2016-10370  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
419557 86430 CVE-2017-7704 97634  View
419558 86430 CVE-2017-7704 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13453  View
419559 86430 CVE-2017-7704 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=6032b0fe5fc1176ab77e03e20765f95fbd21b19e  View
419560 86430 CVE-2017-7704 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=da53a90b6895e47e03c5de05edf84bd99d535fd8  View
419561 86430 CVE-2017-7704 https://www.wireshark.org/security/wnpa-sec-2017-17.html  View

Related JVN