Many OnePlus smartphones have a major SMS vulnerability, and a fix isn’t coming before mid-October | Infinium-tech

If you are using Oxygenos 12, 14, or 15 running OnePlus smartphones, we have news that should be about you. Earlier this week, Cybercity firm Rapid 7 revealed that OnePlus smartphone running these oxygenos versions is a major security defect that can allow malicious apps to SMS and MMS data on your smartphone without permission, user interaction, or consent.

The firm also stated that “the user has also not been informed that SMS data is being accessed,” which “sensitive information can cause disclosure and SMS-based multi-factor authentication (MFA) may effectively break the safety provided by the check.”

Rapid 7 confirmed and confirmed vulnerability on various OnePlus smartphones and oxygen builds, as listed in the table below.

The cyber security firm stated that the vulnerability, which was tracked as CVE-2025–10184, was introduced as part of Oxygenos 12, as versions of Oxygenos 11 were tested, not unsafe on the issue.

Furthermore, while Rapid 7 stated that this safety defect does not seem to be “a hardware-specific issue,” its potential impact is considered high as it affects a main component of Android, and the OnePlus device can be sensitive to it besides Oxygenos 12, 14, or 15 besides the Oxygenos 12, 14, or 15.

OnePlus 10 Pro 5G

Rapid 7 approached OnePlus on 1 May 2025 to discuss the issue for the first time, and since then, it publicly reached half a dozen times of OnePlus and Oppo before revealing its conclusions publicly on 23 September 2025. A day later, OnePlus replied to Rapid 7, accepting the firm’s disclosure and informed them that the Chinese brand was investigating the issue.

OnePlus 8t

OnePlus 10 Pro

OnePlus did not tell Rapid 7 what steps it would take; However, shared in a statement 9to5google Later, a OnePlus spokesman said, “We accept the recent disclosure of CVE-2025-10184 and applied a fix. This will be rolled globally through the software update starting from mid -October. OnePlus customer is committed to the protection of data and will continue to prioritize security reforms.,

So, what can users of the affected OnePlus devices do until the fix in October?

People of Rapid 7 have advised users of affected OnePlus equipment to take the following steps:

• Install the app only from reliable sources and remove all non-essential apps. This will limit the exposure for incredible apps that can employ this permission bypass to read SMS/MMS data.
• Reviews what third-party services use SMS-based multi-factor authentication (MFA) and use an authenticator app to change those services. This will limit the sensitive information being sent to your device on SMS.
• For additional privacy of text messages, users can use an end-to-end messenger app instead of SMS-based communication. This will limit the sensitive information being sent to your device on SMS.
• For third-party services sending SMS-based information, it may be possible to convert in-app into notifications. This will limit the sensitive information being sent to your device on SMS.

you can Click here to read full disclosure by Rapid 7 For more information.