Full Report
Researchers find standards-compliant functionality can be abused to hijack modems, downgrade connections, and even execute code
Analysis Summary
# Vulnerability: Proactive SIM Command Abuse (CATANA Research)
## CVE Details
- **CVE ID:** CVE-2025-48618 (Android Launch Browser), CVD-2026-0122 (GSMA Tracking ID)
- **CVSS Score:** N/A (Severity: High/Critical based on Remote Code Execution and Data Exfiltration)
- **CWE:** CWE-78 (OS Command Injection), CWE-267 (Privilege Defined by Unsafe Mechanism)
## Affected Systems
- **Products:**
- **Smartphones:** Oppo Reno14 F 5G and various Android handsets (Versions 13-16).
- **IoT Modems:** Quectel EC25-AFX, Quectel EG25-G, Semtech modems.
- **Embedded Systems:** Autel EV chargers (using Quectel modules).
- **Versions:** Android 13 through 16 (prior to December 2025 patch).
- **Configurations:** Devices that support "Proactive SIM" functionality, specifically the `RUN AT` command interface which allows a SIM to issue AT commands to the host modem.
## Vulnerability Description
The vulnerability stems from "specification-compliant" functionality within cellular standards. The Proactive SIM framework allows a SIM card to send commands to the host device. Researchers discovered that many devices expose the `RUN AT` command interface, allowing a SIM to execute AT instructions.
- In **IoT devices**, this allowed for command injection into the underlying Linux-based application processors.
- In **smartphones**, this allowed the SIM to bypass OS security boundaries to invoke browser actions (even when locked), disable modem components, or permanently downgrade the network connection to insecure 2G protocols.
## Exploitation
- **Status:** PoC available (CATANA toolkit developed by researchers).
- **Complexity:** Medium (Requires a malicious or compromised SIM card).
- **Attack Vector:** Physical / Network (Supply chain tampering, physical access, or remote compromise of SIM software/OTA administration by a carrier).
## Impact
- **Confidentiality:** High (Arbitrary file reads and data exfiltration via email/attacker servers).
- **Integrity:** High (Remote Code Execution on modem processors; ability to modify system network settings).
- **Availability:** High (Denial of Service via device shutdown, modem termination, or persistent 2G downgrade).
## Remediation
### Patches
- **Android:** Google released patches for Android 13, 14, 15, and 16 in the December 2025 security bulletin.
- **Qualcomm:** Issued a hardened configuration that disables the SIM AT interface by default.
- **Vendors:** Oppo, Quectel, and Semtech were notified in March 2026; users should check for specific firmware updates for these modules.
### Workarounds
- **Firmware Hardening:** Manually disable the `RUN AT` command functionality in modem configurations where possible.
- **Supply Chain Security:** Ensure SIM cards are sourced from trusted providers to prevent pre-installed malicious applets.
## Detection
- **Indicators of Compromise:**
- Devices unexpectedly downgrading to 2G/EDGE and remaining there despite toggling Airplane Mode.
- Unexpected browser launches to unknown URLs (hxxps[:]//...).
- Rapid battery drain or unexpected device reboots.
- **Detection methods:**
- Use of the CATANA toolkit to audit the SIM-to-Modem interface.
- Monitoring for unusual AT command traffic between the SIM card (UICC) and the Application Processor.
## References
- **Research Paper:** hxxps[:]//www[.]usenix[.]org/system/files/woot26-lisowski[.]pdf
- **GSMA Advisory:** CVD-2026-0122
- **Android Security Bulletin:** CVE-2025-48618