Code execution as root via AT commands on the Quectel EG25-G modem (2021)

Re:Code execution as root via AT commands on the Quectel EG2... by 3np on Friday February 11, 2022 @08:52AM (#30301466)

(Published September 2021)

    03/04/2021 - Attempted to contact vendor
    13/04/2021 - Vendor confirmed vulnerability
    23/04/2021 - Vendor issued $2,000 bounty
    24/04/2021 - Assigned ID CVE-2021-31698
    08/09/2021 - Write-up published

Looks like at Pine it's treated as a "Don't fix", or at least it's on Qualcomm to release a new firmware: https://forum.pine64.org/showthread.php?tid=14935

[ Parent | on HN ]

Re:Code execution as root via AT commands on the Quectel EG2... by wthnrtghwr on Friday February 11, 2022 @12:28PM (#30304197)

Quectel, not Qualcomm.

Of course Pine has to treat it as unfixable -- the modem is already an untrusted component out of the box, and the FCC (and peers) would never allow Pine to ship their own modem firmware.

[ Parent | on HN ]

Re:Code execution as root via AT commands on the Quectel EG2... by tinus_hn on Friday February 11, 2022 @05:10PM (#30307613)

Why not? Apple ships their own modem (‘baseband’) firmware.

[ Parent | on HN ]

Re:Code execution as root via AT commands on the Quectel EG2... by xnzakg on Friday February 11, 2022 @05:25PM (#30307741)

The cost of re-certification of the modem with a new firmware is nothing for Apple, but way too much for a smaller company like Pine64.

[ Parent | on HN ]