Recent research has revealed a significant vulnerability in cellular modems integrated into various IoT devices, including electric vehicle chargers, industrial routers, and telematics units. Researchers from the University of Birmingham and Fuzzware discovered that malicious SIM cards can execute commands on these cellular modules, allowing attackers to potentially take over the entire device. In their tests, they found that 9 out of 26 devices were susceptible to this vulnerability, including specific models from OPPO and ASUS. The majority of vulnerable modules were produced by Quectel, and all affected devices used Qualcomm communication processors.
The vulnerability resides in the machine-to-machine hardware, where malicious SIM cards can be inserted manually or introduced through compromised systems. This is particularly concerning for unattended IoT equipment with accessible SIM trays. While Qualcomm has developed a hardened configuration to disable this dangerous interface by default in future devices, no comprehensive patch currently exists. Quectel has addressed some aspects of the vulnerability but has yet to issue a public advisory. The SIM's proactive command capability, exploited by the attackers, is part of the standardized communication specifications, which complicates the resolution as it requires vendor-specific actions to disable or secure the interface.
The research highlights the complexity of the IoT ecosystem, where a small application processor often runs alongside the radio, creating a rich attack surface for hostile SIMs. The researchers demonstrated several alarming scenarios, including the ability to force a phone onto a less secure 2G network and to execute commands on the Quectel modules. Although no attacks using this method have been reported, the findings have been communicated to major companies like Google, Oppo, and Qualcomm. Users with cellular IoT fleets are advised to inquire with their module suppliers about the status of the RUN AT command in their firmware and its potential to be disabled.