Presented at USENIX WOOT in Baltimore this month, research from the University of Birmingham and the security firm Fuzzware makes an argument that is easy to state and unusually hard to dismiss: the SIM card is not a passive credential. It can issue commands to the modem, one of those commands is a general-purpose console, and on a meaningful fraction of devices nothing stops it.
The command is RUN AT. It is a proactive SIM command — part of the standard, not a bug — and it asks the modem to execute an AT command. AT is the modem control language that dates back to the 1981 Hayes Smartmodem. It is still how software talks to cellular hardware.
Put a hostile SIM in a device whose modem honours RUN AT, and you have a shell.
What they tested, and what accepted it
| Category | Tested | Accepted RUN AT |
|---|---|---|
| Phones | 18 | 3 |
| Quectel modules | 8 | 6 |
The three phones were the OPPO Find X5, the OPPO Reno 14 F 5G and the ASUS Zenfone 9. No iPhone and no Pixel was among them.
The modules matter more than the phones. Quectel EC25, EG25 and RM52xN parts are the cellular radios inside industrial routers, telematics units, payment terminals and EV chargers — devices with an accessible SIM tray, a long service life and no update story worth the name.
Three separate failures, one interface
The paper is not a single bug. It is the same interface used three different ways, which is what makes "just patch it" the wrong frame.
The EV charger. On an Autel MAXI US AC W12-L-4G, atfwd_daemon passes attacker-controlled text into a shell call through an unsafe format string. There is a character blocklist. It does not block newlines. Two stages later, that is code execution — driven entirely by commands the SIM issued.
The phone. AT+COPS=0,,,0 pins the handset to 2G. That is not a crash and not a compromise; it is a configuration change the owner cannot undo through any user-facing setting. A device pinned to 2G is a device that will talk to a fake base station.
The module. A TFTP daemon on the Quectel part runs as root and does not check whether a path is a symbolic link. Arbitrary file read, from a SIM.
The common factor is not a coding mistake. It is that the modem trusts the SIM, and the software behind the modem trusts the modem.
The CVE list is shorter than the problem
| Identifier | What it covers |
|---|---|
| CVE-2026-57550 | The SIM AT interface, assigned through Qualcomm |
| CVD-2026-0122 | GSMA tracking for the same issue |
| CVE-2025-48618 | Separate Android flaw — hostile SIM opening web pages on locked Pixels |
| CVE-2021-31698 | Command injection in the same daemon, from 2021 |
That last row is the uncomfortable one. The same daemon had a command injection five years ago. The interface it sits behind was not reconsidered then.
Where the vendors are
Qualcomm has built a hardened configuration that switches the interface off by default, and says it will be the default on future devices, with fixes reaching affected modules as updates.
Quectel has mitigated the file-access flaw and is still working on the interface itself.
Semtech confirmed the findings and plans to ship patches written by Qualcomm.
OPPO and Google treated the findings as informative but outside bug bounty scope.
As of 10 August, none of the five vendors had published a public advisory.
The researchers' position is that the interface should be hardened, deprecated, or disabled outright. No attacks using it have been reported.
Why this is not a phone story
The instinct on reading "malicious SIM card" is to picture a stolen handset. That framing understates it in one direction and overstates it in another.
It overstates it because a phone in your pocket is not where a hostile SIM lands. It understates it because the devices that do have SIM trays sitting in unattended locations — chargers, cabinet routers, telematics boxes, kiosks — are exactly the devices with the weakest software and the longest replacement cycles.
We wrote in July about the Minnesota water systems that were reached through cellular modems rather than through any exploit. The pattern here is adjacent. The cellular link is treated as plumbing — something the network team owns and the security team never models — and the SIM inside it is treated as an identity token rather than as an input.
It is an input.
What to actually do
- Inventory the SIM trays. Not the devices with cellular. The devices where a person can physically reach the SIM. That is a much shorter and much more actionable list.
- Ask your module vendor about RUN AT specifically. "Are you affected by CVE-2026-57550" will get a slower answer than "does your firmware honour the RUN AT proactive command, and can it be disabled."
- Treat 2G pinning as a detectable event. If a fleet device drops to 2G and stays there, that is worth an alert, regardless of cause.
- Do not wait on advisories. Five vendors, no public advisory, three weeks after a conference talk. The hardened Qualcomm configuration is real but it is a default for future devices, which is not the same as a fix for the ones already in cabinets.
The honest summary: this is a standards-level design decision that aged badly, being addressed device by device. That process is going to take years, and the affected hardware has a service life measured in the same units.
