Malicious SIM cards can take over cellular-connected devices

The Hacker News reports that a vulnerability exists in cellular modules and phones that allows a malicious SIM card to execute commands chosen by an attacker, potentially leading to full device takeover. This exposure is particularly concerning for machine-to-machine hardware, including electric vehicle chargers, industrial routers, and car telematics units.

Researchers from the University of Birmingham and Fuzzware discovered that nine out of 26 tested devices, including several Quectel cellular modules and specific OPPO and ASUS phone models, were susceptible to use of the RUN AT command. This command, part of the SIM's standard capabilities, allows it to instruct the modem to execute AT commands, effectively giving the SIM card a general-purpose console. The attack requires a hostile SIM card to be physically inserted or otherwise compromised. Exploitation could lead to severe consequences, such as permanently disabling a phone's cellular connection or enabling a fake base station attack.

While Qualcomm and Quectel have acknowledged the issue and are working on fixes, with Qualcomm having a hardened configuration available and Quectel mitigating a file-access flaw, neither has issued public advisories. The researchers recommend disabling the RUN AT interface where possible, as it is a documented capability rather than a simple bug. The vulnerability is tracked as CVE-2026-57550.

Source: The Hacker News