{"id":44009,"date":"2026-10-21T20:38:29","date_gmt":"2026-10-21T12:38:29","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-70386"},"modified":"2026-10-21T20:38:29","modified_gmt":"2026-10-21T12:38:29","slug":"cve-2026-70386","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-70386","title":{"rendered":"CVE-2026-70386 &#8211; Improper neutralization of special elements used in an OS command (&#8216;OS command injection&#8217;)"},"content":{"rendered":"<p>Improper neutralization of special elements used in an OS command (&#8216;OS command injection&#8217;) and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared<br \/>\nand no user interaction beyond launching it, can execute arbitrary shell<br \/>\n commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects<br \/>\ncombine: (a) OnePlus&#8217;s atlasservice binder interface accepts<br \/>\nsetEvent(String8 name, String8 value) from any caller without<br \/>\nauthorization, and (b) one event handler<br \/>\n(OplusAtlasLogWriter::handleEvent, matching event name<br \/>\natlas_event_multimedia_audio_dumpsys) copies the caller-supplied value<br \/>\ninto the system property oplus.audio.dumpinfo.type and starts the root<br \/>\ninit service audiodumpinfo, which passes that property value unsanitized<br \/>\n to system().\u00a0This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Improper neutralization of special elements used in an OS command (&#8216;OS command injection&#8217;) and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android applica<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-44009","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/44009","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=44009"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=44009"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=44009"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}