Malicious SIMs can shut down phones, steal files, and drag 5G back to 2G
Researchers find standards-compliant functionality can be abused to hijack modems, downgrade connections, and even execute code
A malicious SIM card can disrupt phones and connected devices, exposing them to data leaks, forced downgrades to 2G, self-destruction, and code execution, according to research presented at the USENIX WOOT conference in Baltimore. The vulnerability arises from proactive SIM functionality, which allows SIMs to issue AT commands to devices.
Researchers from the University of Birmingham and Fuzzware developed a toolkit called CATANA to test the impact on 26 devices, including smartphones and IoT modems. Nine devices, primarily IoT modems, exposed an AT command interface to the SIM. The researchers identified four vulnerabilities and demonstrated attacks, including code execution, arbitrary file reads, denial of service, and dropping connections to 2G.
The attackers used the SIM to exploit a command injection bug on an Autel EV charger and an Oppo Reno14 F 5G smartphone, highlighting the potential for SIM-originated file theft. The issue stems from the SIM's defined proactive capabilities in cellular communication specifications, which attackers can exploit. While modern smartphones have largely avoided the vulnerability, the IoT world still faces challenges.
The researchers recommend retiring the RUN AT command, a risky proactive SIM feature, and disabling the SIM AT interface by default on devices. Qualcomm has already implemented a hardened configuration, and the GSMA is tracking the issue as CVE-2025-48618.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
