The recently released OnePlus 6 smartphone allows the booting of arbitrary images, security researchers at Edge Security have discovered.
According to the researchers, the trick is possible using the
fastboot boot image.img feature on the BBK Electronics phone – even when the bootloader is completely locked and in secure mode, as the video embedded in a Twitter update here illustrated.
The vulnerability does require physical access to the handset, as well as a tethered connection to a PC, they said.
David Rogers, chief exec of security consultancy Copper Horse and lecturer for software engineering at University of Oxford, said that the issue with the latest version of the Chinese manufacturer's Android smartphone is nonetheless serious.
"Physical, local attacks are a reality so vendors should not be just dismissing them so easily. That is old school thinking at this point," Rogers told El Reg.
"In CVE terms, yes it would get a lower rating as it not remotely exploitable but that doesn't make the threat zero, just a different type of attack," he added.
In response to queries from El Reg, the smartphone maker told us it was developing a software fix.
"We take security seriously at OnePlus," OnePlus said. "We are in contact with the security researcher, and a software update will be rolling out shortly." ®