4 ms·

(Published September 2021) 03/04/2021 - Attempted to contact vendor 13/04/2021 - Vendor confirmed vulnerability 23/04/2021 - Vendor issued $2,000 b

by 3np 5y ago

(Published September 2021) 03/04/2021 - Attempted to contact vendor 13/04/2021 - Vendor confirmed vulnerability 23/04/2021 - Vendor issued $2,000 bounty 24/04/2021 - Assigned ID CVE-2021-31698 08/09/2021 - Write-up published Looks like at Pine it's treated as a "Don't fix", or at least it's on Qualcomm to release a new firmware: https://forum.pine64.org/showthread.php?tid=14935 https://forum.pine64.org/showthread.php?tid=14935

wthnrtghwr 5y ago
Quectel, not Qualcomm. Of course Pine has to treat it as unfixable -- the modem is already an untrusted component out of the box, and the FCC (and peers) would never allow Pine to ship their own modem firmware.
- tinus_hn 5y ago
  Why not? Apple ships their own modem (‘baseband’) firmware.
  - xnzakg 5y ago
    The cost of re-certification of the modem with a new firmware is nothing for Apple, but way too much for a smaller company like Pine64.