Loading story…
Researchers from the University of Birmingham and Fuzzware disclosed that malicious or compromised SIM cards can abuse standards-compliant SIM Toolkit features, including Proactive SIM and RUN AT, to send AT commands directly to modems in some smartphones and cellular IoT devices. Testing with the CATana toolkit found exposed SIM-to-modem command interfaces on a subset of 26 devices, including multiple Qualcomm-based and Quectel-powered designs, enabling attacks such as arbitrary file reads, denial of service, forced shutdowns, persistent downgrades from 5G to 2G, and in some cases code execution. Demonstrated targets included an Autel EV charger using a Quectel EC25-AFX module, an OPPO Reno14 F 5G, and a Quectel EG25-G modem.
The broader modem interface issue is being tracked as CVE-2026-57550 and GSMA CVD-2026-0122, while a related Android flaw that let a hostile SIM open an attacker-controlled website without user interaction was tracked as CVE-2025-48618 and patched by Google for Android 13 through 16 in December 2025. Qualcomm said it offers a hardened configuration that disables the SIM AT interface by default, and Quectel said it mitigated one file-access flaw and had fixed command injection in newer firmware. The researchers warned that vendor-by-vendor fixes may not be enough and urged deprecation of the RUN AT feature to reduce the attack surface across phones, EV chargers, industrial routers, and vehicle telematics systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
SC Media reported a vulnerability tracked as CVE-2026-57550 that lets a malicious or compromised SIM issue attacker-chosen AT commands through the SIM Toolkit RUN AT capability on certain phones and cellular modules. Researchers said 9 of 26 tested devices were vulnerable, including Quectel modules and specific OPPO and ASUS models, with impacts ranging from device takeover to loss of cellular connectivity and fake base station attacks.
The researchers reported the wider issue to the GSMA after contacting affected vendors. The broader ecosystem issue was then taken up for industry tracking.
The researchers disclosed their findings to Google, Oppo, Quectel, Semtech, and Qualcomm. This vendor-coordination step covered vulnerabilities uncovered through abuse of proactive SIM and RUN AT functionality.
The GSMA began tracking the broader malicious-SIM issue as CVD-2026-0122. Multiple reports describe this as the industry coordination identifier for the exposed SIM AT attack surface.
Google fixed the Android issue tracked as CVE-2025-48618 in Android 13, 14, 15, and 16. The flaw allowed a hostile SIM to trigger LAUNCH BROWSER and open an attacker-controlled website without user interaction, including while the phone was locked.
Quectel said it fixed the separate exploit that allowed arbitrary file reading and exfiltration from the EG25-G module when a specially prepared symbolic link existed. The company was still working on a fix for the broader open SIM AT interface issue.
Researchers from the University of Birmingham and Fuzzware presented findings showing that standards-compliant proactive SIM and RUN AT functionality can be abused to control some phones and cellular IoT devices. Their CATana testing found exposed AT command interfaces on a subset of 26 tested devices and demonstrated impacts including code execution, file theft, denial of service, and forced 2G downgrades.
Qualcomm produced a hardened configuration that disables the SIM AT interface by default. This was a mitigation response to the exposed attack surface identified by the researchers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcescworld.com
Open sourcehelpnetsecurity.com
Open sourcethehackernews.com
Open sourcetheregister.com
Open sourceusenix.org
Open sourceusenix.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
MediaTek disclosed two high-severity modem vulnerabilities, **CVE-2026-20432** and **CVE-2026-20433**, that stem from out-of-bounds writes caused by missing bounds checks in affected modem components. The flaws can allow **remote privilege escalation** when a user equipment device connects to a **rogue base station** controlled by an attacker, potentially exposing confidentiality, integrity, and availability to high impact. Both issues are classified as `CWE-787` and carry severe CVSS v3.1 ratings, with vectors `AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` for CVE-2026-20432 and `AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` for CVE-2026-20433. The vulnerabilities were published through MediaTek’s April 2026 product security bulletin and tracked internally as **MSV-4461** and **MSV-4460**. MediaTek linked the issues to patch identifiers **MOLY01406170** for CVE-2026-20432 and **MOLY01088681** for CVE-2026-20433, indicating that remediation is available for impacted products. Organizations using Huawei devices or other equipment built on affected MediaTek modem components should prioritize vendor patch validation and assess exposure to baseband-level attacks involving malicious cellular infrastructure.
Jun 29, 2026
Qualcomm disclosed and patched several high-severity chipset vulnerabilities affecting Snapdragon, FastConnect, modem, automotive, and IoT products, including **`CVE-2025-27034`**, **`CVE-2025-21483`**, **`CVE-2025-21427`**, **`CVE-2025-27043`**, and **`CVE-2025-21450`**. The flaws span modem, video, RTP, and GPS/GNSS firmware and include remote code execution, memory corruption, buffer over-read, and man-in-the-middle risks. Reported attack paths include malformed PLMN roaming responses, crafted RTP and video-stream payloads, and unauthenticated interception of GNSS assistance data delivered over HTTP. Several issues require no user interaction and affect low-level firmware, raising the risk of bypassing operating system protections; one Qualcomm modem flaw, `CVE-2025-27034`, was reported as exploited in the wild. Qualcomm addressed the issues through July and September 2025 security updates, with exposure likely to persist where OEM firmware rollout lags. Samsung also issued fixes for multiple **Exynos baseband** vulnerabilities, including **`CVE-2024-55568`**, **`CVE-2025-26781`**, **`CVE-2025-26782`**, and **`CVE-2025-54329`**, affecting smartphones, wearables, and modem products. The bugs include NULL pointer dereference, out-of-bounds operations in RLC AM packet handling, and a heap overflow in the NAS signaling layer that can be triggered by malformed LTE or 5G traffic, Mobility Management packets, or multi-payload NAS messages such as SMS. Successful exploitation can crash or hang the modem, reboot devices, or cut off cellular service, and some flaws may be reachable through rogue base stations or compromised network infrastructure before higher-layer authentication or encryption takes effect. Samsung shipped patches in its October and November 2025 security updates, continuing a pattern of baseband security issues previously highlighted in Exynos modem research.
Jun 29, 2026
Qualcomm released security updates for multiple products to fix **one critical** and **five high-severity** vulnerabilities affecting WLAN, modem, and related platform components across a broad set of Snapdragon, FastConnect, QCA, QCN, WCN, WCD, WSA, and modem-RF products. Italy’s national CSIRT said the flaws could enable **arbitrary code execution**, **denial of service**, and **authentication bypass**, and urged organizations to review Qualcomm’s official bulletin for affected versions and remediation details. The most severe issue, **`CVE-2026-25289`**, is a **critical** stack-based buffer overflow in Qualcomm WLAN firmware with a **CVSS 9.6** score, caused by memory corruption when processing malformed Device Capability Extended attributes in certain NAN Service Discovery Frames. Qualcomm also disclosed **`CVE-2026-24079`**, a **high-severity** missing-authentication flaw in data modem registration handling rated **CVSS 8.1**, which can be triggered with malformed or absent authentication parameters; available records indicate no known exploitation for either issue, but customers were advised to apply vendor patches and update affected system software promptly.
Aug 4, 2026