{"uuid": "15d4b856-a3c3-4e11-a721-2a3b12b501ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24033", "type": "seen", "source": "https://t.me/hacking_Attack/94947", "content": "Black Hat Ethical Hacking\nSamsung Users at Risk: 18 Zero-Day Vulnerabilities Found in Exynos Chipsets\n\nSamsung Users at Risk: 18 Zero-Day Vulnerabilities Found in Exynos ChipsetsPost Views: 46 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Google\u2019s Project Zero uncovers 18 zero-day vulnerabilities in Samsung Exynos chipsetsGoogle\u2019s bug-hunting team, Project Zero, has identified 18 zero-day vulnerabilities in Samsung\u2019s Exynos chipsets used in mobile devices, wearables, and cars. These vulnerabilities were discovered between late 2022 and early 2023, and four of them were deemed the most serious. The flaws allow remote code execution from the Internet to the baseband, enabling attackers to compromise vulnerable devices without any user interaction.\n\nThe security flaws, including CVE-2023-24033 and three others still awaiting a CVE-ID, were described as \u201cInternet-to-baseband remote code execution (RCE) bugs.\u201d Samsung acknowledged the vulnerability in a security advisory, stating that the baseband software does not properly check the format types of accept-type attribute specified by the SDP, which can lead to denial of service or code execution in Samsung Baseband Modem.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Four of the identified Exynos modem security flaws enable remote code executionTim Willis, the Head of Project Zero, has warned that experienced attackers could easily create an exploit that remotely compromises vulnerable devices without triggering the target\u2019s attention. Due to the high level of access these vulnerabilities provide, Project Zero has delayed disclosure for the four vulnerabilities that allow for Internet-to-baseband remote code execution.\n\nThe remaining 14 flaws, including CVE-2023-24072, CVE-2023-24073, CVE-2023-24074, CVE-2023-24075, CVE-2023-24076, and nine others awaiting CVE-IDs, are less critical but still pose a risk. Successful exploitation requires local access or a malicious mobile network operator.\nEnd-users still don't have patches 90 days after report\u2026. https://t.co/dkA9kuzTso\n\n\u2014 Maddie Stone (@maddiestone) March 16, 2023\nSamsung has already provided security updates addressing these vulnerabilities in impacted chipsets to other vendors. However, patches are not public and can\u2019t be applied by all affected users. Each manufacturer\u2019s patch timeline for their devices will differ. Google, for instance, has already addressed CVE-2023-24033 for impacted Pixel devices in its March 2023 security updates.\nTrending: Major Cyber Attacks of 2022\nTrending: Offensive Security Tool: CrackQL Google and Samsung urge users to update devices to mitigate Exynos chipset flawsUntil patches are available, users can disable Wi-Fi calling and Voice-over-LTE (VoLTE) to remove the attack vector and thwart baseband RCE exploitation attempts targeting Samsung\u2019s Exynos chipsets in their device. Samsung has confirmed Project Zero\u2019s workaround and encourages end-users to update their devices as soon as possible to ensure that they are running the latest builds that fix both disclosed and undisclosed security vulnerabilities.\nTrending: Proof-of-concept for critical Microsoft Word vulnerability published\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/u[...]", "creation_timestamp": "2026-09-01T20:01:02.554253Z"}