Four of the most severe vulnerabilities allowed for internet-to-baseband remote code execution, allowing an attacker to "remotely compromise a phone at the baseband level with no user interaction and require only that the attacker know the victim's phone number."
"With limited additional research and development, we believe that skilled attackers would be able to quickly create an operational exploit to compromise affected devices silently and remotely," Willis warned.
YOUTUBE RESTORES TRUMP'S CHANNEL, ABILITY TO UPLOAD NEW CONTENT AHEAD OF 2024 ELECTION
The logo of Google is displayed on a carpet at the entrance hall of Google France in Paris, Nov. 18, 2019. (AP Photo/Michel Euler, File)
The 14 other vulnerabilities were not quite as severe, as they require either a malicious mobile network operator or an attacker with local access to the device.
Willis said that the affected products likely include Samsung mobile devices in the S22, M33, M13, M12, A71, A53, A33, A21s, A13, A12 and A04 series, as well as those from Vivo in the S16, S15, S6, X70, X60 and X30 series. Also included were the Pixel 6 and Pixel 7 series of devices from Google and any vehicles that use the Exynos Auto T5123 chipset.
BEST BROWSER ALTERNATIVES FOR THE ONCE-POPULAR, NOW-RETIRED INTERNET EXPLORER
A large-scale advertismenet for Google Pixel 7 outside London Bridge station on November 17, 2022, in London, United Kingdom. ((Photo by Mike Kemp/In Pictures via Getty Images))
Google said that patch timelines would vary per manufacturer. Project Zero researcher Maddie Stone tweeted that Samsung had 90 days to patch the bugs, but has not yet done so. The Pixel devices are already patched with the March security update.
A woman walks past an advertisement for the Samsung Galaxy S22 smartphone at the company's Seocho building in Seoul on July 7, 2022. ((Photo by JUNG YEON-JE/AFP via Getty Images))
In the meantime, users who wish to protect themselves from the baseband remote code execution vulnerabilities in the post can turn off Wi-Fi calling and Voice-over-LTE (VoLTE) in their device settings.
"As always, we encourage end users to update their devices as soon as possible, to ensure that they are running the latest builds that fix both disclosed and undisclosed security vulnerabilities," Willis added.