- Top reward
- $6,036
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 15
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $6,036
- for critical bugs, from $121.
- Report on Compass Security
- Submit through the program page.
Rewards
What Compass Security lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$6,036 |
Reward range in US dollars. Compass Security's own page has the details.
Scope
13 assets you may test, 3 excluded.
Networks 7
- 213.146.8.101
- 213.146.8.102
- 213.146.8.103
- 213.146.8.104
- 213.146.8.106
- 213.146.8.3
- 62.2.177.201
Domains 4
- chmedia.ch
- chmedia.ch/marken
- oneplus.ch
- stv.oneplus.ch
Android apps 1
- https://play.google.com/store/apps/details?id=com.apponeplus.mobile
iOS apps 1
- https://apps.apple.com/app/oneplus/id1591028623
Out of scope (3)
- event.chmedia.ch
- gedenkzeit.ch
- login.chmedia-welcome.ch
Changes
Tracked since 12 Nov 2026. Last checked 38 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2023-26309 | A remote code execution vulnerability in the webview component of OnePlus Store app. | High 7.4 | 10 Aug 2023 |
| CVE-2020-13626 | OnePlus App Locker through 2020-10-06 allows physically proximate attackers to use Google Assistant to bypass an authorization check in order to send an SMS message when the SMS application is locked. | Medium 4.6 | 9 Oct 2020 |
| CVE-2020-7958 | An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privileged user (root) in the Rich Execution Environment (REE) to obtain bitmap images from the fingerprint sensor because of Leftover Debug Code. The issue is that the Trusted Application (TA) supports an extended number of commands beyond what is needed to implemen | Medium 6.0 | 14 Apr 2020 |
| CVE-2017-5947 | An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier. The attacker can reboot the device into the Qualcomm Emergency Download (EDL) mode through ADB or by using Volume-Up when connected to USB, which in turn could allow for downgrading partitions such as the Android Bootloader. | Medium 6.8 | 29 Mar 2018 |
| CVE-2017-11105 | The OnePlus 2 Primary Bootloader (PBL) does not validate the SBL1 partition before executing it, although it contains a certificate. This allows attackers with write access to that partition to disable signature validation. | Critical 9.8 | 3 Aug 2017 |
| CVE-2016-10370 | An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs (due to the digital signature), it unnecessarily increases the attack surface, and allows for remote exploitation of other vulnerabilities such as CVE-2017-5948, CVE-2017-8850, and CVE-2017-8851. | High 7.5 | 11 May 2017 |
| CVE-2017-5948 | An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to downgrade attacks. This is due to a lenient 'updater-script' in OTAs that does not check that the current version is lower than or equal to the given image's. Downgrades can occur even on locked bootloaders and without triggering a factory reset, allowing for exploitation of now-patched vulne | Medium 5.9 | 11 May 2017 |
| CVE-2017-8850 | An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlus OTA images, and the fact that both ROMs use the same OTA verification keys, attackers can install HydrogenOS over OxygenOS and vice versa, even on locked bootloaders, which allows for exploitation of vulnerabilities patched on one image but not on the other, in addition to expansion of t | Medium 5.9 | 11 May 2017 |
| CVE-2017-8851 | An issue was discovered on OnePlus One and X devices. Due to a lenient updater-script on the OnePlus One and X OTA images, the fact that both products use the same OTA verification keys, and the fact that both products share the same 'ro.build.product' system property, attackers can install OTAs of one product over the other, even on locked bootloaders. That could theoretically allow for exploitat | Medium 5.9 | 11 May 2017 |
| CVE-2017-5625 | In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader to partially dump the ciphertext content of an arbitrary partition (except 'keystore') by issuing the 'fastboot oem dump <partition>' fastboot command. | Medium 4.6 | 25 Apr 2017 |
| CVE-2017-5622 | With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled. Therefore, a malicious charger or a physical attacker can open up, without authorization, an ADB session with the device, in order to further exploit other vulnerabilities and/or exfiltrate sensitive information. | Medium 5.9 | 26 Mar 2017 |
| CVE-2017-5623 | An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of the device by issuing the 'fastboot oem boot_mode {rf/wlan/ftm/normal} command' in contradiction to the threat model of Android where the bootloader MUST NOT allow any security-sensitive operation to be run unless the bootloader is unlocked. | Medium 6.6 | 19 Mar 2017 |
| CVE-2017-5624 | An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the (locked) bootloader start the platform with dm-verity disabled, by issuing the 'fastboot oem disable_dm_verity' command. Having dm-verity disabled, the kernel will not verify the system partition (and any other dm-verity protected partition), which may allow for persistent code execution a | Critical 9.8 | 12 Mar 2017 |
| CVE-2017-5626 | OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands (4F500301 and 4F500302) that allow the attacker to lock/unlock the bootloader, disregarding the 'OEM Unlocking' checkbox, without user confirmation and without a factory reset. This allows for persistent code execution with high privileges (kernel/root) with complete access to user data. | Critical 9.8 | 12 Mar 2017 |
| CVE-2017-5554 | An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which could be done without any authentication. A physical attacker can press the "Volume Up" button during device boot, where an attacker with ADB access can issue the adb reboot bootloader command. Then, the attacker can put the platform's SELinux in permissive m | High 8.1 | 23 Jan 2017 |