[vlovich123]

To be fair, the discussion here is not about baseband processors afaik but the infra that the baseband talks to. Of course you could use that as a hop point to infect all attached basebands because they suffer from a software monoculture and you could get a lot of them. Other less obvious attacks would be selectively downgrading the protocol phones can see the tower using to remove the encryption capabilities. This is similar to what Stingray base stations do.

[myself248]

Exactly. Control of the management/cellular network is not _precisely equivalent to_ control of every machine/phone attached to it, you still have to attack the BMCs/BBs.

But I think it's safe to assume there's always a BMC/BB vuln, especially if the firmware development for it takes place in that same adversary's country. Not having the adversary on your management network in the first place is probably sane.