CVE-2017-5622 in OxygenOS
Summary
by MITRE
With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled. Therefore, a malicious charger or a physical attacker can open up, without authorization, an ADB session with the device, in order to further exploit other vulnerabilities and/or exfiltrate sensitive information.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2020
This vulnerability exists in OxygenOS versions prior to 4.0.3 on OnePlus 3 and 3T devices, representing a critical security flaw that compromises device integrity during power state transitions. The issue stems from improper platform initialization when charging a powered-off device, creating an unexpected security exposure that undermines the device's fundamental security model. The vulnerability allows unauthorized access through the Android Debug Bridge (ADB) protocol, which is typically disabled by default on production devices to prevent unauthorized debugging access. When a charger is connected to a powered-off OnePlus 3 or 3T device, the system automatically boots with adbd (Android Debug Bridge) service enabled, bypassing normal security controls that should prevent such access. This behavior creates a window of opportunity for attackers to establish unauthorized ADB sessions without requiring authentication or physical access to the device's secure elements. The flaw fundamentally violates the principle of least privilege by enabling debugging services during device startup, even when the device is in a powered-off state. This vulnerability aligns with CWE-284 Access Control Issues, specifically addressing inadequate access controls during device boot processes, and maps to ATT&CK technique T1059 Command and Scripting Interpreter where attackers can leverage ADB access to execute commands. The security implications extend beyond simple unauthorized access, as the enabled ADB session allows for potential privilege escalation, data exfiltration, and further exploitation of other device vulnerabilities.
The operational impact of this vulnerability is severe as it transforms a device's power management behavior into a security vector that can be exploited by both malicious hardware and physical attackers. An attacker with access to a malicious charger can simply connect it to a powered-off device to establish an ADB session, effectively bypassing all device-level security controls that would normally prevent unauthorized access. This vulnerability also affects physical attackers who may have access to the device during charging operations, as the system automatically enables debugging capabilities without requiring user interaction or authentication. The attack surface is particularly concerning because ADB access allows for complete device control, including the ability to install malicious applications, access encrypted data, modify system files, and extract sensitive information from the device's memory. The vulnerability essentially creates a backdoor mechanism that operates automatically during device power-on events, making it extremely difficult for users to detect or prevent such unauthorized access. Security researchers have noted that this flaw represents a failure in the device's secure boot process, where the system should maintain strict security boundaries even during power state transitions. The vulnerability also demonstrates poor separation of concerns in the platform's initialization sequence, where security controls are not properly enforced during the early boot stages of the device.
Mitigation strategies for this vulnerability should focus on both immediate device-specific fixes and broader platform security improvements. Users should immediately update to OxygenOS 4.0.3 or later versions where this vulnerability has been patched, as the update properly disables ADB services during power-off states and ensures that debugging capabilities are only enabled when explicitly requested by authorized users. Device manufacturers should implement proper secure boot processes that enforce strict access controls during all device power states, ensuring that debugging services are never automatically enabled without explicit user authorization. The patch for this vulnerability typically involves modifying the device's boot scripts and initialization processes to prevent automatic enabling of adbd during power-on events from external power sources. Organizations should also implement monitoring systems that can detect unauthorized ADB sessions and alert security personnel to potential compromise. Network security teams should consider implementing device authentication and authorization controls that can detect and block unauthorized ADB connections from external sources. The vulnerability highlights the importance of secure power management in mobile device security and demonstrates the need for comprehensive security testing during all device boot and power state transitions. From a compliance perspective, this vulnerability could impact organizations that must meet security standards such as NIST SP 800-53 or ISO 27001, as it represents a failure to maintain proper access controls during device initialization phases. The incident also underscores the necessity of hardware security modules and secure element implementations that can prevent unauthorized access even when device software is compromised or misconfigured.