The Indian Computer Emergency Response Team (CERT-In) has issued a warning to Android users. The cyber security authority has spotted “high risk” vulnerabilities on Android smart phones powered by Qualcomm and MediaTek chipsets. It added that the smartphones affected are running on Android versions 12, 12L, 13, and 14 software.
These multiple vulnerabilities can be exploited by an attacker to get access to sensitive information and gain elevated privileges. As per the warning, these vulnerabilities exist in Android due to flaws in the Framework, System, Kernel, Arm component, Imagination Technologies, MediaTek components, Qualcomm components and Qualcomm closed-source components.
Notably, the critical security flaw identified in the Framework component poses a risk of privilege escalation, allowing attackers to gain elevated access without any additional execution privileges. The severity of this vulnerability is determined by its potential impact on affected devices, assuming that typical security measures are disabled or successfully evaded.
To protect your Android Smartphone from this potential security threat, to update to the latest version of Android where possible. Additionally, turn on auto-updates so that your software operating system is up to date, minimizing the possibility of such security threats. Make sure that you download apps from trusted platforms only like Google Play Store. It is also advised not to click on links sent via unsolicited messages, email and more.
CERT-In has also issued a “severe” warning for Apple users who own iPhones, iPads, Macs, and more regarding multiple vulnerabilities. As per the warning, these vulnerabilities can expose users to risks like information leaks, unauthorized code execution, security bypasses, denial of service (DoS) attacks, and spoofing attacks.
The advisory stated, “Multiple vulnerabilities have been reported in Apple products which could allow an attacker to access sensitive information, execute arbitrary code, bypass security restrictions, cause denial of service (DoS) and perform spoofing attacks on the targeted system”.
