"The SIM's proactive capability and the attack surface it opens are explicitly defined in the technical specifications for cellular communication," said Marius Muench, assistant professor in computer science at the University of Birmingham.
What researchers tested and found
Researchers at the University of Birmingham and the security firm Fuzzware examined 26 devices — a mix of phones and cellular modules — for whether a SIM could use its proactive commands to run code on the modem or the module's application processor. Nine of the 26 accepted the dangerous command. Six of eight cellular modules accepted it; only three of 18 phones did. The three phones that accepted the command were named: the OPPO Find X5, the OPPO Reno 14 F 5G, and the ASUS Zenfone 9. No iPhone or Pixel in the tested set accepted it.
How the RUN AT attack works in practice
The attack leverages a standardized SIM proactive command called RUN AT, which asks a modem to execute an AT command — the modem-control language vendors extend in their own ways. Supporting RUN AT hands a SIM card a general-purpose console. On many modules the researchers examined, a small application processor (often Android on an ARM Cortex-A7) receives AT commands the radio does not handle and forwards them to a richer operating environment: "a rich attack surface to hostile SIMs," the paper says.
In one demonstration the team used a hostile SIM to take control of a commercial Autel EV charger (model MAXI US AC W12-L-4G). The charger contains a Quectel EC25AFXDGA module whose atfwd_daemon passed attacker-controlled text into a shell call through an unsafe format string. A character blocklist was intended to prevent shell escapes but a newline bypassed it; after two stages the researchers achieved code execution entirely driven by SIM-issued commands. The researchers disclosed the issue to Quectel, which then notified its customers; Autel itself was not listed among the companies the write-up says were notified.
On an OPPO Reno 14 F 5G, the command AT+COPS=0,,,0 pinned the phone to 2G and the owner could not undo it by any of the usual actions. Two further commands powered the handset down and shut off the modem. The researchers' tooling, released as CATana, enumerated 198 AT commands reachable through the SIM on that OPPO handset.
A third case used a Quectel EG25‑G module whose TFTP daemon runs as root and does not check for symbolic links; the researchers read arbitrary files and then mailed them out using AT+QSMTP commands. That particular chain required a malicious link already present on the module filesystem — placed there by an SD card or a crafted partition flash — in addition to the hostile SIM.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleVendor responses, CVEs and the disclosure timeline
The team reported the findings to Google, Oppo, Quectel, Semtech and Qualcomm in March 2026, and to the GSMA in May. The exposed SIM AT interface is tracked as CVE-2026-57550, assigned through Qualcomm, and as CVD-2026-0122 by the GSMA, though the CVE Program's published list had not yet shown the CVE record as of the report. Oppo and Google considered the findings informative but outside their bug-bounty scope.
Qualcomm told the researchers it has built a hardened configuration that switches the interface off by default. Quectel said it has mitigated the file-access flaw and indicated the command-injection issue was already known and fixed in newer firmware, but it has not published affected or fixed version numbers. Semtech confirmed the findings and plans to ship patches written by Qualcomm. As of August 10 none of the five vendors had issued a public advisory, Quectel's advisory portal remains gated behind a login, and the researchers said they had not seen any proof-of-exploitation in the wild.
The paper notes precedent: an AT-reachable command injection in the same daemon was published in 2021 as CVE-2021-31698. Separately, while developing this work the group had earlier shown a hostile SIM could make a locked Android phone open an attacker-controlled web page on several Pixels; Google patched that different flaw as CVE-2025-48618 in December 2025.
What this means for operators, Quectel, Qualcomm and phone OEMs
- Operators of cellular IoT fleets: the researchers highlight that unattended IoT gear with accessible SIM trays and few other interfaces is a prime target because an attacker only needs physical or supply-chain access to swap or insert a hostile SIM. The immediate step researchers suggest is to ask module suppliers whether RUN AT is enabled in shipped firmware and whether it can be disabled.
- Quectel and other module vendors: the survey indicates the affected modules include Quectel EC25, EG25 and RM52xN series and likely others built on Qualcomm modems; vendors must decide whether to harden, deprecate or disable the interface and whether fixes will remove the vulnerable RUN AT code paths or merely switch them off.
- Qualcomm and phone OEMs (Oppo, ASUS, Google): Qualcomm reports a hardened default configuration; OEMs should confirm whether their shipped firmware uses that configuration. Oppo and Google treated the findings as outside bounty scope, a posture operators and regulators will note while evaluating mitigation coverage.
Takeaway
The work underscores a structural risk: a standardized SIM capability, RUN AT, can hand a hostile card a console into a modem and — where a module couples a radio to a general-purpose application processor — into a small Linux/Android host. Patches and vendor configuration changes are available paths, but the researchers warn the most reliable mitigation may be architectural: hardening, deprecating, or disabling the proactive SIM AT interface in devices that do not need it. For now, the practical action is simple and immediate for operators: ask module suppliers whether RUN AT is enabled in the firmware they shipped, and whether it can be disabled.
