A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices

Summary: Researchers at the University of Birmingham and Fuzzware tested 26 phones and cellular modules and found the SIM-initiated RUN AT command accepted on 9 of them, including 6 of 8 cellular modules and 3 of 18 phones, and used it to run their own code on a commercial Autel EV charger identified as model MAXI US AC W12-L-4G. All nine accepting devices run a Qualcomm communication processor, five of the six modules were Quectel parts, and the researchers say the interface is tracked as CVE-2026-57550 through Qualcomm and CVD-2026-0122 by the GSMA, with no public vendor advisory issued as of August 10 and no exploitation reported.
What you should know: Every attack requires a hostile card already in the slot, and unattended IoT gear with an accessible SIM tray is exactly where that swap is worth making - Muench said the team is fairly confident every module in Quectel's EC25, EG25 and RM52xN series is affected, and Quectel does not release firmware updates publicly, so no one has put a figure on how many are in service.

Read the original at The Hacker News ↗