Loading vulnerability…
CVE-2026-57550 is an exposure in certain Qualcomm-based cellular modules and smartphones where the SIM Toolkit proactive command RUN AT is accepted, allowing a malicious or compromised SIM card to cause the modem to execute attacker-chosen AT commands. The issue stems from SIM-originated access to an exposed AT command interface that should not be broadly available to untrusted SIMs. Researchers found the interface reachable on a subset of tested devices, particularly several Quectel modules and some OPPO and ASUS phones. Depending on the device and supported AT command set, exploitation can enable actions such as disabling the modem, powering down the device, forcing a persistent downgrade to 2G, reading files in some module environments, and in at least one demonstrated IoT case contributing to arbitrary code execution through a separate command-injection flaw in the module software stack. The vulnerability is especially significant in unattended machine-to-machine and IoT deployments where SIM replacement or supply-chain compromise is plausible.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability involving an exposed SIM-to-modem AT command interface that allows a malicious SIM card to send modem commands, enabling impacts such as arbitrary code execution, file access, disabling connectivity, and forcing 2G downgrade on affected devices.
A vulnerability in cellular modules and phones that allows a malicious or compromised SIM card to use the RUN AT command capability to execute attacker-chosen AT commands on the modem, potentially enabling device takeover or disruption.
An exposed SIM AT interface issue in Qualcomm-based cellular modules and some phones that allows a malicious SIM to issue RUN AT proactive commands to the modem, potentially enabling device takeover or other harmful actions depending on vendor implementation.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.