CVE-2017-5948

CVE-2017-5948 describes a downgrade vulnerability affecting OnePlus One, X, 2, 3, and 3T devices running OxygenOS and HydrogenOS. This flaw allows attackers to revert devices to older, potentially vulnerable software versions due to lenient "updater-script" checks during over-the-air (OTA) updates. The vulnerability has a CVSSv3 score of 5.9 (Medium), indicating a high integrity impact with high attack complexity, as it can be exploited via Man-in-the-Middle attacks targeting unencrypted update transactions or through physical access. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered some community discussion, suggesting awareness among researchers.