Nokia has admitted that the security flaws exposed by Adam Gowdiak of Security Explorations are genuine, and that a miscreant exploiting them could do whatever they like to a Series 40 phone just by knowing the phone number.
Gowdiak posted some details earlier this month, with claims that by exploiting the flaws he could remotely install an application onto a Series 40 handset, and then provide that application with enough security permissions to execute any command he wished. Nokia has been a week or two getting back to us, but this morning admitted that they have "been investigating the allegations made, using our normal processes and comprehensive testing... We can confirm that both claims are valid in some of our products."