Unrated

Open SIM AT Interface in Qualcomm-Based Cellular Modules and Phones

IdentifiersCVE-2026-57550CWE-284

CVE-2026-57550 is an exposure in certain Qualcomm-based cellular modules and smartphones where the SIM Toolkit proactive command RUN AT is accepted, allowing a malicious or compromised SIM card to cause the modem to execute attacker-chosen AT commands. The issue stems from SIM-originated access to an exposed AT command interface that should not be broadly available to untrusted SIMs. Researchers found the interface reachable on a subset of tested devices, particularly several Quectel modules and some OPPO and ASUS phones. Depending on the device and supported AT command set, exploitation can enable actions such as disabling the modem, powering down the device, forcing a persistent downgrade to 2G, reading files in some module environments, and in at least one demonstrated IoT case contributing to arbitrary code execution through a separate command-injection flaw in the module software stack. The vulnerability is especially significant in unattended machine-to-machine and IoT deployments where SIM replacement or supply-chain compromise is plausible.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation gives an attacker with control of the SIM card the ability to issue modem commands that can materially alter device behavior. Observed impacts include denial of service through modem shutdown or device power-off, persistent forced downgrade to 2G that can facilitate fake base-station attacks, access to sensitive files in certain module configurations, and, where additional downstream flaws exist in modem-side software, arbitrary code execution and potential full device takeover. The risk is particularly high for embedded and industrial deployments such as EV chargers, routers, and telematics units because compromise can affect connectivity, integrity, and potentially the broader attached system.

Mitigation

If you can’t patch tonight, do this now.

Where patches are not yet available, reduce exposure by preventing use of untrusted or replaceable SIM cards, physically securing SIM slots, and tightening supply-chain controls for SIM provisioning and operator relationships. Disable or restrict the RUN AT interface where the platform permits it. Prioritize review of unattended IoT and M2M deployments using Qualcomm-based modules, especially environments where a hostile SIM could be inserted or provisioned. Monitor for anomalous modem behavior such as unexplained 2G downgrades, modem disablement, or unexpected AT-driven state changes, and segment affected devices to limit downstream impact if compromise occurs.

Remediation

Patch, then assume compromise.

Apply vendor-provided updates and hardened configurations that disable SIM-originated AT command access by default. Qualcomm has prepared an additional protection that disables SIM access to AT commands by default, and downstream vendors using affected Qualcomm-based designs should integrate and ship that configuration. Module vendors should also patch any modem-side flaws reachable through AT commands, including command-injection and file-access issues in supporting services and daemons. Asset owners should obtain updated firmware from device or module manufacturers and validate that SIM Toolkit RUN AT access is no longer exposed to untrusted SIMs.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

3 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware1

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity