Loading story…
Researchers and CERT/CC disclosed a serious flaw in Verizon's VoLTE implementation, alleging the carrier's IMS core voice network lacked required IPsec ESP protection for SIP signaling between user equipment and the P-CSCF after IMS AKA authentication. According to the disclosure tied to CERT/CC advisory VU#615987, observed registration traffic was missing expected security headers and analysts reportedly found no encrypted signaling during active voice calls across multiple devices and operating systems, despite 3GPP TS 33.203 and GSMA IR.92 requirements.
The reported exposure could allow an on-path attacker to intercept and manipulate cellular signaling, enabling call hijacking, spoofing, denial-of-service, and potentially misrouting emergency calls. Apple released iOS 26.5 with updated carrier settings, but the disclosure said that did not confirm effective protections were active in production, and researchers further claimed Verizon stopped cooperating with coordinated vulnerability disclosure efforts and had not provided verifiable evidence that the issue was mitigated.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers disclosed a severe flaw in Verizon's IMS core voice network, alleging required cryptographic protections for SIP signaling were absent. The disclosure says exposed signaling could enable interception and manipulation of traffic, including call hijacking, spoofing, denial-of-service, and emergency-call misrouting.
Apple released iOS 26.5 with updated carrier settings. The reporting notes this occurred amid the Verizon IMS vulnerability story, but says it does not verify that effective protections are active in production.
CERT/CC published VU#615987 describing missing IPsec integrity protection for IMS SIP signaling in Verizon VoLTE deployments. The advisory documents the issue as a product vulnerability affecting Verizon's VoLTE environment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a two-stage exploit chain in **Unisoc** modem firmware that can turn a VoLTE video call into **full Android kernel access** on vulnerable devices. The attack combines a previously published remote code execution flaw in the `UNISOC T612` modem stack with a newly revealed privilege-escalation weakness caused by inadequate isolation between the modem and application processor. After a target answers an incoming video call, code running in the modem context can map and alter kernel memory because both components share physical memory without a hardware-enforced boundary. SSD Secure Disclosure said the issue was validated on devices including the **Motorola E13** and **Xiaomi Redmi A5**, and reported that the flaw has **no CVE**, no vendor response, no patch, and no published mitigation. The attack is not trivial because it requires the adversary to operate a **private 4G network**, but the technique echoes prior modem-to-system compromise research, including Kaspersky ICS CERT’s demonstration of remotely pivoting from a vehicle modem into a head unit. Neither the August 2026 Android Security Bulletin nor any UNISOC bulletin reportedly addresses the newly disclosed escalation bug.
Aug 20, 2026
Qualcomm disclosed and patched several high-severity chipset vulnerabilities affecting Snapdragon, FastConnect, modem, automotive, and IoT products, including **`CVE-2025-27034`**, **`CVE-2025-21483`**, **`CVE-2025-21427`**, **`CVE-2025-27043`**, and **`CVE-2025-21450`**. The flaws span modem, video, RTP, and GPS/GNSS firmware and include remote code execution, memory corruption, buffer over-read, and man-in-the-middle risks. Reported attack paths include malformed PLMN roaming responses, crafted RTP and video-stream payloads, and unauthenticated interception of GNSS assistance data delivered over HTTP. Several issues require no user interaction and affect low-level firmware, raising the risk of bypassing operating system protections; one Qualcomm modem flaw, `CVE-2025-27034`, was reported as exploited in the wild. Qualcomm addressed the issues through July and September 2025 security updates, with exposure likely to persist where OEM firmware rollout lags. Samsung also issued fixes for multiple **Exynos baseband** vulnerabilities, including **`CVE-2024-55568`**, **`CVE-2025-26781`**, **`CVE-2025-26782`**, and **`CVE-2025-54329`**, affecting smartphones, wearables, and modem products. The bugs include NULL pointer dereference, out-of-bounds operations in RLC AM packet handling, and a heap overflow in the NAS signaling layer that can be triggered by malformed LTE or 5G traffic, Mobility Management packets, or multi-payload NAS messages such as SMS. Successful exploitation can crash or hang the modem, reboot devices, or cut off cellular service, and some flaws may be reachable through rogue base stations or compromised network infrastructure before higher-layer authentication or encryption takes effect. Samsung shipped patches in its October and November 2025 security updates, continuing a pattern of baseband security issues previously highlighted in Exynos modem research.
Jun 29, 2026
Rapid7 disclosed **`CVE-2026-0826`**, a critical unauthenticated stack-based buffer overflow in HP Poly **VVX** and **Trio** VoIP phones that can allow remote code execution as **root**. The flaw resides in SDP parsing of ICE candidate attributes within the `polyapp` binary when the non-default **ICE** feature is enabled. Rapid7 demonstrated exploitation against a Poly VVX 450 running firmware `6.4.7.4477`, showing that existing mitigations were not sufficient in practice: **NX** was enabled, but the binary lacked **PIE**, and some shared libraries loaded at fixed addresses despite nominal **ASLR**, enabling a **ROP**-based exploit. HP said the issue affects all VVX models and several Trio conference phones, assigned it a **CVSSv4 9.2**, and released patched firmware while advising administrators to disable ICE if it is not required. The disclosure also warned that compromised enterprise desk phones can become stealthy footholds for persistence, lateral movement, traffic interception, and call manipulation, while exposing sensitive audio from executive offices and conference rooms. Rapid7 said the risk extends beyond traditional espionage because control of trusted business phones could support **AI-enabled impersonation**, including vishing and deepfake-assisted fraud, underscoring that VoIP endpoints should be treated as fully networked computers rather than benign office appliances.
Jun 29, 2026