Multiple Internet to Baseband Remote Code Execution Vulnerabilities in Exynos Modems
Summary: Google Project Zero reported eighteen 0-day vulnerabilities in Exynos Modems made by Samsung Semiconductor in late 2022 and early 2023, four of which (CVE-2023-24033, CVE-2023-26496, CVE-2023-26497 and CVE-2023-26498) allow Internet-to-baseband remote code execution. Project Zero's tests confirmed those four let an attacker remotely compromise a phone at the baseband level with no user interaction, requiring only that the attacker know the victim's phone number.
What's compelling: A compromise that needs nothing from the user but their phone number, and that Project Zero believes skilled attackers could turn into a silent remote exploit with limited additional work, puts the baseband below every app-layer control your mobile fleet relies on.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-24033CVE-2023-26072CVE-2023-26073CVE-2023-26074CVE-2023-26075CVE-2023-26076CVE-2023-26496CVE-2023-26497CVE-2023-26498
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026