Critical SIM Card Vulnerability Enables Remote Smartphone Takeover: RUN AT Attack Explained + Video

Introduction:

A joint research effort by the University of Birmingham and Fuzzware has uncovered a dangerous security flaw affecting SIM cards that allows attackers to take complete control of a target smartphone remotely. The vulnerability, tracked as CVE-2025-48618 and CVD-2026-0122, leverages a proactive SIM command mechanism called RUN AT to execute arbitrary code, exfiltrate files, disable connectivity, and force devices to downgrade to the insecure 2G protocol. This attack vector poses a significant threat to IoT devices, industrial routers, electric vehicle charging stations, and automotive telematics systems.

Learning Objectives:

Understand the technical mechanics of the RUN AT SIM vulnerability and how malicious SIM cards can compromise mobile devices
Identify vulnerable device models and assess organizational exposure to SIM-based attacks
Implement comprehensive mitigation strategies across Linux, Windows, and mobile platforms

You Should Know:

1. Understanding the RUN AT Attack Mechanism

The vulnerability stems from a feature within the SIM card ecosystem known as proactive commands—specifically the RUN AT instruction. A compromised or maliciously crafted SIM card can send AT (Attention) commands directly to the device’s modem, bypassing the operating system’s security controls. The researchers developed a toolkit called CATana that enables security professionals to test which AT commands a SIM card can send to a modem and assess the associated consequences.

Step‑by‑step guide explaining what this does and how to use it:

The attack chain unfolds as follows:

SIM Compromise: An attacker either physically replaces the victim’s SIM card with a malicious one or exploits supply chain vulnerabilities to pre-load malicious firmware onto SIM cards before distribution.
Command Injection: The malicious SIM sends a RUN AT proactive command to the device’s modem. This command instructs the modem to execute an AT command of the attacker’s choosing.
Arbitrary Code Execution: The executed AT command can perform various actions:

– Read and exfiltrate files from the device’s storage
– Disable cellular connectivity entirely
– Force the device to downgrade from 5G/LTE to the vulnerable 2G protocol, enabling interception attacks
– Open malicious websites or initiate SMS-based phishing campaigns

Persistence: The attack requires no physical interaction with the device after the initial SIM insertion, making it particularly dangerous for IoT deployments where SIM cards are often pre-installed and remotely managed.

Testing and Detection Commands (Linux/macOS):

To identify potential SIM vulnerabilities in your environment, security teams can use the following tools and commands:

 Check modem status and identify AT command interfaces
mmcli -L  List available modems
mmcli -m 0 --command='AT+CGMI'  Get modem manufacturer information
mmcli -m 0 --command='AT+CGMM'  Get modem model information

Enable verbose modem logging to detect suspicious AT commands
sudo journalctl -u ModemManager -f

Monitor serial communication with the modem (requires root)
sudo cat /dev/ttyUSB2  Replace with appropriate modem interface

Windows PowerShell Commands for Modem Analysis:

 Query mobile broadband device information
Get-WmiObject -Class Win32_PnPEntity | Where-Object { $<em>.Name -like "mobile" -or $</em>.Name -like "modem" }

Enable verbose logging for mobile broadband events
wevtutil set-log "Microsoft-Windows-MobileBroadband/Operational" /enabled:true /retention:false /maxsize:20971520

Query recent mobile broadband events
Get-WinEvent -LogName "Microsoft-Windows-MobileBroadband/Operational" -MaxEvents 50

2. Affected Devices and Risk Assessment

Testing conducted by the researchers revealed that six out of eight IoT cellular modules and three out of eighteen smartphones responded to malicious SIM instructions. The vulnerable smartphone models identified include:

Oppo Find X5
Oppo Reno 14 F 5G
Asus Zenfone 9

Notably, iPhones and Google Pixel devices were not found to be vulnerable, and Qualcomm has prepared a hardened configuration that disables the RUN AT functionality by default. However, the risk extends significantly to IoT ecosystems, industrial routers, and automotive telematics systems where SIM cards are often embedded and not user-replaceable.

Step‑by‑step guide for device inventory and risk assessment:

Inventory SIM-Enabled Devices: Create a comprehensive inventory of all devices in your organization that use cellular connectivity, including smartphones, tablets, IoT sensors, industrial routers, and connected vehicles.
Check Vendor Security Advisories: Monitor vendor security bulletins for patches addressing CVE-2025-48618 and CVD-2026-0122. Google patched Android 13-16 in December 2025.
Test Device Susceptibility: For critical devices, consider using the CATana toolkit developed by the researchers to test which AT commands your devices accept from the SIM.
Prioritize Remediation: Focus first on IoT devices and industrial systems, as these often lack the update mechanisms available on consumer smartphones.

3. Mitigation Strategies for Organizations

The GSMA has registered this vulnerability and manufacturers are actively introducing countermeasures. Organizations should implement a multi-layered defense strategy:

Step‑by‑step guide for enterprise mitigation:

Disable Proactive SIM Commands: Where possible, configure device modems to reject or ignore RUN AT and other proactive SIM commands. Qualcomm has already prepared a hardened configuration that disables this by default.
Implement SIM PIN Protection: Set a strong, custom PIN for all company-issued device SIM cards to prevent unauthorized physical SIM replacement.
Transition Away from SMS-Based Authentication: Replace SMS-based two-factor authentication with phishing-resistant methods such as FIDO2 security keys, passkeys, or authenticator applications.
Enable Carrier-Level Protections: Request that your mobile provider enable port protection or SIM lock on your accounts.
Establish Supply Chain Security: Implement rigorous supply chain审查 and溯源 mechanisms to prevent the introduction of compromised SIM cards.

Sample Configuration for Disabling RUN AT on Linux-based Modems:

 Disable proactive SIM commands via AT command (vendor-specific)
echo 'AT+CPROT=0' > /dev/ttyUSB2  Disable proactive SIM features

For Quectel modems, disable RUN AT specifically
echo 'AT+QCFG="simpro",0' > /dev/ttyUSB2

Persist configuration across reboots (add to modem initialization script)
echo 'AT&W' > /dev/ttyUSB2  Write configuration to modem NVRAM

4. Cloud and API Security Considerations

For organizations leveraging IoT devices that communicate with cloud APIs, the SIM vulnerability presents an additional attack surface. A compromised device could be used as a pivot point to access cloud infrastructure:

Step‑by‑step guide for API security hardening:

Implement Device Attestation: Use hardware-based attestation to verify device integrity before allowing API access.
Enforce Mutual TLS (mTLS): Require devices to present client certificates that are cryptographically bound to the hardware, making SIM-based impersonation more difficult.
Monitor for Anomalous Behavior: Deploy machine learning-based anomaly detection to identify unusual device behavior patterns that may indicate compromise.
Implement Zero Trust Architecture: Adopt Zero Trust Identity and Access Management principles that never trust device identity implicitly and continuously verify authentication.

5. Windows and Enterprise Mobility Management

For Windows-based enterprise environments managing mobile devices:

Step‑by‑step guide for Windows MDM configuration:

Enforce Device Compliance Policies: Configure Microsoft Intune or other MDM solutions to require specific security patches (including CVE-2025-48618 fixes) before allowing device access.
Disable Legacy Protocols: Use Group Policy or MDM to force devices to prefer 5G/LTE and disable 2G fallback where possible to prevent downgrade attacks.
Monitor Mobile Device Events: Implement SIEM monitoring for mobile broadband events that may indicate SIM tampering or malicious command execution.

Windows Registry Settings for Mobile Security Hardening:

 Disable 2G fallback (vendor and device specific)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MobileBroadband]
"Disable2GFallback"=dword:00000001

Enable enhanced modem logging for security monitoring
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Modem]
"Logging"=dword:00000001

6. Future-Proofing with eSIM and Hardware Security

While the current vulnerability affects physical SIM cards, eSIM technology introduces its own security considerations. However, eSIMs offer some advantages:

Step‑by‑step guide for eSIM security:

Understand eSIM Benefits: eSIMs are hardwired into the device and not removable, eliminating the risk of physical SIM replacement attacks.
Secure eSIM Provisioning: Always use activation codes from trusted sources and ensure the eUICC identifier is registered with the server during profile ordering.
Wipe eSIM Data on Device Replacement: Always wipe eSIM data when replacing devices to prevent unauthorized access.
Monitor eSIM Vulnerabilities: Stay informed about eSIM-specific vulnerabilities such as those identified in Kigen’s eUICC cards.

What Undercode Say:

Key Takeaway 1: The RUN AT vulnerability represents a fundamental design flaw in how SIM cards interact with device modems. The attack requires no user interaction and can persist indefinitely once a malicious SIM is inserted, making it particularly dangerous for IoT deployments where SIM cards are often embedded and not user-accessible.
Key Takeaway 2: The research from the University of Birmingham and Fuzzware demonstrates that the threat landscape extends far beyond consumer smartphones. Industrial routers, electric vehicle charging stations, and automotive telematics systems are all at risk, potentially enabling large-scale infrastructure attacks.

Analysis: This vulnerability is particularly concerning because it targets the modem level, bypassing operating system security controls entirely. The ability to force devices to downgrade to 2G is especially dangerous, as it enables legacy interception attacks that were thought to be mitigated by modern cellular protocols. The researchers’ development of the CATana toolkit is a significant contribution to the security community, enabling proactive testing and identification of vulnerable devices. Organizations should prioritize this vulnerability given its potential for widespread exploitation, particularly in IoT and industrial environments where patch management is often challenging. The fact that Qualcomm has already prepared hardened configurations is encouraging, but widespread adoption will require coordinated efforts from device manufacturers, mobile operators, and enterprise security teams.

Prediction:

-1 The vulnerability will be weaponized by advanced persistent threat (APT) groups within 3-6 months, targeting industrial control systems and government personnel who rely on cellular-connected devices.
-1 IoT device manufacturers will face significant reputational and financial damage as thousands of deployed devices are found to be unpatchable due to hardware limitations.
+1 The incident will accelerate the adoption of hardware-based attestation and Zero Trust architectures in mobile and IoT security frameworks.
+1 GSMA and industry standards bodies will mandate stricter security requirements for SIM card implementations, including the restriction or removal of proactive command capabilities.
-1 Consumer trust in mobile device security will erode, particularly in regions where SIM card supply chains are less regulated.
+1 The security research community will develop automated scanning tools to detect RUN AT vulnerabilities, enabling organizations to assess their exposure at scale.

▶️ Related Video (84% Match):

https://www.youtube.com/watch?v=6BMYuBYYGA8

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: https://lnkd.in/p/e4e_Cx8r – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Listen to this Post