Malicious SIM Card Flaw Exposes Cellular IoT Devices to Remote Takeover

A malicious SIM card can run attacker-controlled code directly inside the cellular modems powering electric-vehicle chargers, industrial routers, and automotive telematics units, according to new research from the University of Birmingham and security firm Fuzzware. The flaw centers on the RUN AT proactive SIM command, a legacy feature in the GSM specification that lets a SIM card push an AT command — the modem control language inherited from the 1981 Hayes Smartmodem — back to the cellular modem for execution. Supporting that interface effectively hands the SIM card a general-purpose console into the device, allowing it to read files, modify settings, and execute arbitrary commands.

The researchers tested 26 phones and cellular modules and found 9 devices that accepted the RUN AT command. Among the eight embedded cellular modules evaluated, six were vulnerable — five of them built by Quectel, including parts pulled from a commercial EV charger, an industrial router, and a car telematics control unit. On the handset side, only 3 of 18 phones were affected: the OPPO Find X5, the OPPO Reno 14 F 5G, and the ASUS Zenfone 9. No iPhone or Pixel was found to be vulnerable. Every one of the nine compromised devices runs a Qualcomm communication processor, though five other Qualcomm-based handsets in the survey did not accept the command, suggesting that vendor customization of the modem firmware determines exposure rather than the chipset itself.

The attack requires more than knowing a victim's phone number. The hostile SIM must already be physically present in the device — whether inserted by hand, slipped in as a thin interposer, pushed out by a compromised mobile operator, or subverted in software or on the production line. That makes unattended cellular IoT gear with an accessible SIM tray and few other exposed interfaces the most attractive target, since the physical-access trade-off is minimal compared to the full device takeover it yields. Marius Muench, assistant professor at the University of Birmingham, said the SIM's proactive command interface should be hardened, deprecated, or disabled outright.

Both Qualcomm and Quectel have responded. Qualcomm told the researchers it has built a hardened configuration that disables the interface by default, and Quectel says it has mitigated the related file-access flaw and is still working on the interface itself. Neither vendor has published a public advisory, and Quectel's vulnerability portal requires a login to view disclosures. The hardened configuration will ship as the default on future devices, and patches are expected to reach affected modules, though the team has not confirmed whether the RUN AT code paths are fully removed or merely switched off. No real-world attacks using the interface have been reported. For organizations running cellular IoT fleets today, the immediate step is to ask the module supplier whether RUN AT is enabled on shipped firmware and whether it can be disabled, while also auditing the public attack surface of connected devices with an open port scanner and verifying transport security on the management plane with an SSL/TLS configuration checker.