University of Birmingham researchers reveal SIM cards can issue modem commands phones cannot block, with CVE-2025-48618 patched but the underlying RUN AT channel still live across millions of devices. Key findings: - The CATana toolkit fuzzes the Proactive SIM interface (3GPP TS 31.111 / ETSI TS 102 223), specifically the RUN AT COMMAND defined in Section 6.4.23, which lets a SIM push arbitrary AT commands to the baseband. Testing 26 devices found 4 exploitable paths: forced 4G-to-2G downgrade, silent locked-screen browser launch, file exfiltration, and code execution on a modem application processor. - CVE-2025-48618 (CVSS 6.8) is the Android elevation-of-privilege flaw in processLaunchBrowser inside http://CommandParamsFactory.java, patched December 2025 for Android 13-16. The OPPO Reno 14 F accepted 198 AT command variants via SIM; the 2G downgrade persisted through airplane mode and manual network resets with no user toggle to undo it. - Quectel EC25-AFX modems in an AUTEL EV charger were fully compromised via SIM-injected command injection into the Linux application processor. Quectel modems appear in industrial routers, telematics, and automotive systems. GSMA tracking ID: CVD-2026-0122. For incident responders: a SIM swap or physically substituted card is now a credible initial access vector, not just a fraud concern. Verify Android December 2025 patch level across your device fleet. #DFIR_Radar
Post summary
Researchers expose that SIM cards can issue unrestricted modem commands, detailing exploitation paths and an Android privilege‑elevation flaw (CVE‑2025‑48618) patched in Dec 2025. The report urges verification of patch levels across fleets.