CVE-2016-10370: An issue was discovered on OnePlus devices such as the 3T.

Security readout for executives and security teams

Some OnePlus phones, including the 3T, received OTA update images over unencrypted HTTP. The updates were still digitally signed, so this alone is not evidence of arbitrary firmware installation. The business concern is added attack surface: a network attacker could interfere with update delivery and potentially combine it with other OnePlus updater vulnerabilities. Exposure is most likely in legacy OnePlus fleets or BYOD devices using affected OTA updater behavior, especially OnePlus 3T-class devices. The source bundle does not provide complete affected version ranges, CPEs, or confirmed fixed builds. Prioritize if legacy OnePlus devices can access corporate data or trusted networks. The issue is not reported as actively exploited here, but it weakens update security and can amplify other vulnerabilities. Unsupported devices should be restricted or removed. Mitigation focus: Check OnePlus guidance and firmware notes for fixed OTA updater behavior.; Update affected devices to a vendor-supported firmware build where available.; Retire or restrict unsupported legacy OnePlus devices from sensitive access..

Prepared

Jun 13, 2026, 05:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.