A compromised SIM card can send commands that take full control of the device it's installed in, according to research published this week by the University of Birmingham and security firm Fuzzware. The vulnerability is most dangerous in machine-to-machine hardware like electric-vehicle chargers, industrial routers, and vehicle telematics units, where a hostile card can execute code and commandeer the entire system. The researchers tested 26 phones and cellular modules and found that 9 accepted the attack command, allowing them to run their own software on a commercial EV charger.
The exposure sits overwhelmingly in industrial cellular modules rather than consumer phones. Six of the eight cellular modules the team examined accepted the command, while only 3 of 18 phones did: the OPPO Find X5, the OPPO Reno 14 F 5G, and the ASUS Zenfone 9. No iPhone or Pixel was vulnerable. Five of the six affected modules were manufactured by Quectel, three of which the researchers pulled from an EV charger, an industrial router, and a car's telematics control unit. Every one of the nine devices that accepted the command runs a Qualcomm communication processor, though five other Qualcomm-based handsets in the survey did not accept it, which the paper attributes to vendor customization. The researchers released their tooling as CATana, which identified 198 AT commands reachable through the SIM on one of the affected OPPO handsets.
The attack requires physical or supply-chain access to insert the malicious card, according to the researchers, who say it can be swapped by hand, slipped in as a thin interposer, pushed out by a compromised operator, or subverted in software or on the production line. Knowing the victim's phone number isn't enough. Marius Muench, assistant professor in computer science at the University of Birmingham, said in the university's announcement that the SIM's proactive capability and the attack surface it opens are "explicitly defined in the technical specifications for cellular communication," which is why he frames the result as compliant with the standard rather than a break from it. The command in question, RUN AT, is part of the standardized set a SIM can push back at the modem and asks the modem to execute an AT command, handing the card a general-purpose console.
The researchers' own position is that the interface should be hardened, deprecated, or disabled outright. Qualcomm told the researchers it has built a hardened configuration that switches the interface off by default, and that hardened configuration will be the default on future devices. Quectel says it has mitigated the file-access flaw and is still working on the interface itself. Neither has published an advisory, and the module maker's vulnerability portal requires a login to see anything at all. For anyone running cellular IoT fleets, the step available today is to ask the module supplier whether RUN AT is enabled in the firmware they shipped and whether it can be disabled. No attacks using the interface have been reported. The architecture of IoT modules makes the problem worse: nearly every module the team examined runs a small application processor alongside the radio, usually Android on an ARM Cortex-A7, which means the card ends up talking to what the paper, presented this week at USENIX WOOT in Baltimore, calls "a rich attack surface to hostile SIMs." The individual flaws are ordinary bugs and can be patched, but the interface that exposes them is a documented capability, and switching it off is a decision each vendor makes for its own products. Supply-chain visibility becomes the practical lever when a standardized feature turns into an exploitable pathway, and operators who don't control the firmware release cycle will need contractual assurances that weren't previously part of procurement conversations.