OnePlus CVE-2025–10184: Ditch SMS 2FA Now
Timely heads-up: CVE–2025–10184 is a OnePlus/OxygenOS issue that allows a malicious app to read and send SMS/MMS without user consent. That makes SMS-based MFA (texted one-time codes) vulnerable to interception/abuse. Below is your fast, practical playbook — first for individuals, then for BYOD/IT — plus detection scripts you can run today and signals to watch until vendor patches land.
Need help prioritizing risk and closing gaps? We do this every day for SaaS, healthcare, and fintech teams — see our Risk Assessment Services and Remediation Services.
TL;DR (for busy humans)
- What it means: If a rogue app can silently access SMS, SMS 2FA is unsafe on affected OxygenOS builds.
- What to do now: Switch accounts to TOTP (authenticator app) or FIDO2/security keys. Remove shady apps, and update as soon as the fix ships.
- For BYOD fleets: Detect at-risk OnePlus devices, enforce non-SMS MFA, restrict unknown app installs, and message users with simple, copy-paste steps.
- Keep watch: Track OxygenOS build updates, Android security patch level, and CVE bulletin notes for CVE–2025–10184.
What is CVE–2025–10184, and why does it break SMS-MFA
CVE-2025–10184 is an OxygenOS permission bypass that lets an app read incoming OTPs and send texts without a runtime prompt. That undercuts the “second factor” because attackers can auto-capture codes (even initiate SMS themselves in some flows).
Affected surface: select OnePlus devices running OxygenOS builds before the patch. Until OnePlus publishes the fixed builds, treat any unpatched OnePlus as risky for SMS-based 2FA.
Get Pentest_Testing_Corp’s stories in your inbox
Join Medium for free to get updates from this writer.
How to self-check (device side):
Settings → About device → Android security update (month) and OxygenOS version. If you don’t see a post-disclosure build (or the changelog referencing SMS permission fixes), do not rely on SMS 2FA yet.
Personal risk reduction (right now)
- Kill SMS as a factor in critical logins
- Move your accounts to TOTP (Authy/Microsoft/Google Authenticator) or FIDO2 keys.
- Delete phone numbers as recovery options where possible.
- Rotate passwords if you suspect interception.
2. App hygiene
- Uninstall any app you don’t recognize.
- Reboot. Then reinstall only from the Play Store, reviewing permissions.
3. Patch posture
- Manually check for System Update daily until a fixed OxygenOS build is offered.
- After patching, re-enable SMS 2FA only if necessary (prefer staying on TOTP/FIDO2).
Want a quick security baseline while you wait on vendor patches? Run our free scanner and share the report internally: Website Vulnerability Scanner online free.
Screenshot of our free Website Vulnerability Scanner home/tool UI
Detecting risky apps (local + ADB)
These examples help you spot third-party apps holding SMS permissions (READ_SMS/SEND_SMS) and whether those permissions are granted.
ADB one-liner: list third-party packages with SMS perms granted
# List 3rd-party packages that currently have READ/SEND SMS granted
adb shell 'for p in $(pm list packages -3 | cut -d: -f2); do
dumpsys package "$p" | grep -E "requested permissions|granted=true" | \
awk -v pkg="$p" "/android.permission.(READ_SMS|RECEIVE_SMS|SEND_SMS)/ && /granted=true/ {print pkg, $0}"
done' | sort -uADB + AppOps: find SMS ops set to allow/ignore (no prompt)
# Show SMS-related appops for each app
adb shell 'for p in $(pm list packages -3 | cut -d: -f2); do
echo "== $p =="; appops get "$p" | grep -Ei "(read|write|send).*sms|receive_mms"
done'Kotlin (on-device) to enumerate SMS permissions + grant state
val pm = applicationContext.packageManager
val packages = pm.getInstalledPackages(PackageManager.GET_PERMISSIONS)
packages.filter { (it.requestedPermissions ?: emptyArray())
.any { rp -> rp.contains("READ_SMS") || rp.contains("SEND_SMS") || rp.contains("RECEIVE_SMS") } }
.forEach { pkg ->
val granted = pkg.requestedPermissions?.mapIndexed { idx, perm ->
val flag = pkg.requestedPermissionsFlags?.get(idx) ?: 0
perm to ((flag and PackageInfo.REQUESTED_PERMISSION_GRANTED) != 0)
}?.toMap() ?: emptyMap()
println("${pkg.packageName} -> $granted")
}Python helper to summarize dumpsys output
import subprocess, re
pkgs = subprocess.check_output(["adb","shell","pm","list","packages","-3"]).decode().splitlines()
sms = re.compile(r'android\.permission\.(READ|RECEIVE|SEND)_SMS')
out = []
for line in pkgs:
pkg = line.split(":",1)[1].strip()
d = subprocess.check_output(["adb","shell","dumpsys","package",pkg]).decode()
grants = [g for g in re.findall(r'android\.permission\.[A-Z_]+_SMS.*granted=(true|false)', d) if g]
if sms.search(d) and "granted=true" in d:
out.append(pkg)
print("\n".join(sorted(set(out))))What to do if you find offenders: uninstall them, reboot, and change any passwords for accounts that used SMS codes recently.
BYOD / MDM guidance (practical & enforceable)
1) Detect risky devices
Use your EMM/MDM inventory to filter Manufacturer=OnePlus and flag devices with Android security patch level older than the vendor-fixed month once released. If your MDM supports custom inventory, capture:
ro.product.manufacturer,ro.product.modelro.build.version.ota,ro.build.version.security_patch
Sample compliance rule (pseudocode/JSON):
{
"ruleId": "oneplus-cve-2025-10184",
"if": {
"platform": "Android",
"manufacturer": "OnePlus",
"securityPatchBefore": "2025-10-01"
},
"then": { "markNonCompliant": true, "message": "Update OxygenOS; SMS MFA blocked." }
}2) Block SMS as a factor; require phishing-resistant MFA
- IdP policy: remove SMS from allowed factors for Android logins; require FIDO2/WebAuthn or Authenticator (TOTP).
- Okta-style policy example:
{
"name": "Android-No-SMS-MFA",
"conditions": { "platform": ["Android"] },
"enroll": { "allowedFactors": ["fido2", "totp"], "disallowedFactors": ["sms","call"] },
"riskPolicy": { "elevateTo": "fido2" }
}- Entra ID (Azure AD) Conditional Access (conceptual):
{
"conditions": { "platforms": ["Android"] },
"grantControls": { "builtInControls": ["fido2","authenticatorStrengthHigh"] },
"sessionControls": { "signInFrequency": "8h" }
}3) Tighten app-install policies
- Disable unknown sources (side-loading) in device restrictions.
- Require Play Integrity/Play Protect on corporate profile.
- App protection: block data transfer to apps not on an allow-list.
Intune-style App Protection sample (schema-lite):
{
"policyName": "Android-Block-Unknown-And-No-SMS",
"copyPaste": "managedAppsOnly",
"backupToPersonal": false,
"allowListPackages": ["com.google.android.apps.authenticator2"],
"blockListPermissions": ["READ_SMS","SEND_SMS","RECEIVE_SMS"]
}4) Communications (paste-ready)
Subject: OnePlus/OxygenOS alert — Turn off SMS 2FA today
Body: If you use a OnePlus device for work, do not use SMS for 2FA until we confirm the OxygenOS patch for CVE–2025–10184. Switch to our approved Authenticator app or your FIDO2 key. Update daily and remove unneeded apps. Questions? Reply to this email or message IT.
Sample report page from the free tool to check Website Vilnerability
Signals to watch (and how to verify patch level)
- Vendor advisory/OTA notes for CVE–2025–10184.
- Android Security Patch Level date advances (Settings → About device).
- OxygenOS build number increments beyond your current build.
- Your MDM inventory shows previously non-compliant devices flipping to compliant.
When in doubt, re-run the ADB checks above — no third-party app should retain SMS perms after you patch and clean house.
Where to go deeper (related reading & services)
- Browse more real-time vulnerability playbooks on our Blog (e.g., Cisco, Juniper, Citrix responses):
[CVE-2025–20352: Cisco IOS/IOS XE SNMP 0-Day — Fix Now]
[CISA KEV Adds CVE-2025–5086: What You Must Do]
[Citrix NetScaler CVE-2025–7775: Fix & Verify]. - Get a prioritized remediation roadmap with our Risk Assessment Services and hands-on Remediation Services. If you need an external pulse-check or attestation for stakeholders, start here: Pentest Testing Corp — Home.
- Run a quick public-facing check while you coordinate: Free Website Security Scanner.
