University of Birmingham researchers, working with Fuzzware, have shown that a malicious SIM card can take full control of EV charging stations, industrial routers and vehicle telematics units by exploiting a 1981-era AT command interface still present in modern cellular modules.
26 devices tested, nine compromised
The team inserted modified SIM cards into 26 devices comprising 18 smartphones and eight cellular modules. Nine devices accepted and executed commands sent from the SIM. Six of the eight modules were vulnerable, five of them Quectel units taken from commercial EV chargers, industrial routers and automotive T-Box systems. Only three phones were affected: OPPO Find X5, OPPO Reno 14 F 5G and Asus Zenfone 9. iPhone and Pixel devices proved immune. All nine vulnerable devices used Qualcomm modems, yet five other Qualcomm phones resisted the commands, indicating the issue stems from vendor-specific configuration rather than the chipset itself.
RUN AT: a standards-compliant backdoor
AT commands, first defined by Hayes in 1981, remain the native control language for every cellular module. The RUN AT proactive command, explicitly allowed by 3GPP specifications, lets the SIM instruct the modem to run any AT string. When the baseband cannot process a command it is forwarded to the application processor, typically an ARM Cortex-A7 running a full Linux environment. This architecture turns the tiny SIM into a privileged console with direct access to the host operating system.
Three working attack chains
On an Autel MAXI US AC W12-L-4G charger the atfwd_daemon on the Quectel EC25 module contained an unsafe format string that allowed shell escape via a newline character, granting code execution driven entirely by SIM-originated commands. On the OPPO Reno 14 F 5G an AT+COPS command permanently locked the device to 2G networks, defeating airplane mode, manual network selection and SIM disablement, thereby enabling subsequent rogue-base-station attacks. On the Quectel EG25-G a root TFTP daemon combined with the built-in AT+QSMTP command permitted arbitrary file read and email exfiltration once a malicious symlink was present in the filesystem.
Disclosure timeline and vendor response
Vendors were notified in March 2026 and GSMA was informed in May. The flaws are tracked as CVE-2026-57550 (Qualcomm channel) and CVD-2026-0122 (GSMA). As of 10 August no public advisories have been published. Google and OPPO classified the reports as informational; Semtech confirmed the issue will be addressed with Qualcomm patches; Quectel acknowledged the problem but restricts its security portal to logged-in users. High has introduced a default-disabled configuration for future modules, yet existing stock remains exposed.
Recommended actions for asset owners
- Inventory every cellular-equipped device, recording module model, firmware version and physical accessibility of the SIM slot.
- Contact module suppliers to determine whether RUN AT is enabled in shipped firmware and request a timeline for patches.
- Apply physical tamper protection such as epoxy or locks on unattended equipment and establish reliable over-the-air update channels.
