Pierluigi Paganini December 06, 2023

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds four Qualcomm vulnerabilities to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA)  Qualcomm vulnerabilities to its .

Below is the list of the issues added to the catalog:

•  Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability
•  Qualcomm Multiple Chipsets Use-After-Free Vulnerability
•  Qualcomm Multiple Chipsets Integer Overflow Vulnerability
•  Qualcomm Multiple Chipsets Use-After-Free Vulnerability

The vendor the flaws CVE-2023-33106, CVE-2023-33107, and CVE-2023-33063 in October 2023. The company also warned that three of the zero-day vulnerabilities were actively exploited in attacks in the wild. CVE-2022-22071 was included in our May 2022 public bulletin.

Google Threat Analysis Group and Google Project Zero first reported that the CVE-2023-33106, CVE-2023-33107, CVE-2022-22071 and CVE-2023-33063 were actively exploited in targeted attacks.

Google Threat Analysis Group and Google Project Zero experts focus on attacks carried out by nation-state actors or surveillance firms, this means that one of these threat actors may be behind the exploitation of the Qualcomm flaws.

According to , FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts recommend also private organizations review the  and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix these vulnerabilities by December 26, 2023.

Follow me on Twitter:  and  and Mastodon

(SecurityAffairs – hacking, CISA)