Full Report
A malicious SIM card can order the device it sits in to run commands of the attacker's choosing. On the cellular modules built into electric-vehicle chargers, industrial routers, and car telematics units, that is enough to take the whole device over. Researchers at the University of Birmingham and the security firm Fuzzware tested 26 phones and cellular modules for the capability, found it
Analysis Summary
# Vulnerability: Malicious SIM "RUN AT" Command Execution
## CVE Details
- **CVE ID:** Not explicitly listed in the article (Commonly associated with proprietary Qualcomm/Quectel firmware vulnerabilities).
- **CVSS Score:** N/A (Not disclosed, but high potential impact for IoT and telematics).
- **CWE:** CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-134 (Use of Externally-Controlled Format String).
## Affected Systems
- **Products:**
- **Cellular Modules:** Primarily Quectel (e.g., EC25AFXDGA used in EV chargers/routers).
- **Smartphones:** OPPO Find X5, OPPO Reno 14 F 5G, and ASUS Zenfone 9.
- **IoT Devices:** Autel MAXI US AC W12-L-4G EV charger, industrial routers, and car telematics units.
- **Versions:** Firmware utilizing Qualcomm communication processors with the `RUN AT` proactive command interface enabled.
- **Configurations:** Devices where the modem is configured to accept and execute AT commands directly from the SIM card via the "RUN AT" proactive command.
## Vulnerability Description
The flaw stems from the implementation of "proactive commands" within cellular standards. Specifically, the `RUN AT` command allows a SIM card to push AT (Hayes) commands to the modem's processor.
In many IoT modules, these commands are passed to an internal application processor (often running Linux/Android). Researchers found that the `atfwd_daemon` in certain Quectel modules fails to properly sanitize these inputs, allowing for shell escapes (using characters like newlines) and format string attacks. This grants the SIM card a general-purpose console to execute arbitrary code on the underlying operating system.
## Exploitation
- **Status:** PoC available (Demonstrated by researchers at USENIX WOOT). No known exploitation in the wild.
- **Complexity:** Medium (Requires crafting a malicious SIM or using a hardware interposer).
- **Attack Vector:** Physical / Adjacent (Requires a hostile SIM card to be physically inserted, swapped, or a compromised SIM profile delivered via OTA by a rogue operator).
## Impact
- **Confidentiality:** High (Full access to the device OS and data).
- **Integrity:** High (Ability to run arbitrary code and modify device firmware/settings).
- **Availability:** High (Ability to brick devices or permanently lock them to obsolete network standards like 2G).
## Remediation
### Patches
- **Qualcomm:** Has developed a "hardened configuration" that disables the `RUN AT` interface by default.
- **Quectel:** Reported to have mitigated the specific file-access flaw, but a comprehensive fix for the interface itself is still in progress. Note: Accessing Quectel's vulnerability portal requires a login.
### Workarounds
- **Fleet Operators:** Contact module suppliers to verify if the `RUN AT` command is enabled in current firmware and request instructions to disable it.
- **Physical Security:** Secure SIM trays on unattended IoT hardware to prevent physical tampering or the insertion of interposer "shims."
## Detection
- **Indicators of Compromise:** Unexpected device behavior (e.g., a phone permanently stuck on 2G), unusual AT command logs (if logging is enabled), or unauthorized file system changes.
- **Detection Methods:** Security auditing of modem firmware to check if the `RUN AT` capability is active.
## References
- **USENIX Research Paper:** [https://www.usenix.org/system/files/woot26-lisowski.pdf](https://www.usenix.org/system/files/woot26-lisowski.pdf)
- **Researcher Presentation:** [https://www.usenix.org/conference/woot26/presentation/lisowski](https://www.usenix.org/conference/woot26/presentation/lisowski)
- **Technical Context:** [https://thehackernews[.]com/2019/09/simjacker-mobile-hacking.html](https://thehackernews[.]com/2019/09/simjacker-mobile-hacking.html)