GSMA

Malicious SIM Card Commands Hijack EV Chargers and IoT Modules via Legacy AT Interface

Researchers from the University of Birmingham and Fuzzware demonstrated that a single malicious SIM card can issue proactive commands forcing cellular modules to execute arbitrary AT instructions. Testing of 26 devices revealed nine vulnerable units, including six out of eight cellular modules from Quectel used in EV chargers, industrial routers, and automotive T-Box systems. The attack leverages the long-standardized RUN AT proactive command introduced in 1981, which allows the SIM to instruct the modem and, in many cases, the application processor running Linux. Concrete exploits were shown on an Autel MAXI US AC W12-L-4G charger, an OPPO Reno 14 F 5G phone locked to 2G, and a Quectel EG25-G module enabling file exfiltration. Five vendors were notified in March 2026 yet none have issued public advisories as of August; the issues are tracked as CVE-2026-57550 and CVD-2026-0122. High Qualcomm-based modules remain widely deployed in critical infrastructure with no centralized visibility or uniform disablement mechanism.

Compromised SIM Cards Exploit Proactive SIM to Steal Files, Execute Code and Force 2G on Smartphones and IoT Devices

Researchers from the University of Birmingham and Fuzzware have demonstrated that a compromised SIM card can issue commands to smartphones and IoT devices by abusing the standard Proactive SIM feature. The attack leverages the RUN AT command to force the modem to execute AT commands, creating a direct channel from the SIM to the device hardware. Using their CATana toolkit, the team tested 18 smartphones and eight cellular IoT devices, finding the AT command interface exposed on two phones and seven IoT units. Four vulnerabilities were identified, enabling code execution, file theft, denial of service and persistent downgrade to 2G. Affected devices include the OPPO Reno14 F 5G and Quectel-based modules such as the EC25-AFX and EG25-G. Manufacturers have released some patches, and GSMA has registered the issue as CVD-2026-0122, though researchers recommend removing the RUN AT function entirely from firmware.