Malicious SIM Cards Can Execute Code on Cellular IoT Modems, Researchers Find

Researchers at the University of Birmingham and the security firm Fuzzware have discovered that a malicious SIM card can execute attacker-controlled code on cellular modems used in IoT devices. The team tested 26 phones and cellular modules, finding the vulnerable capability enabled in 9 of them. They successfully ran their own code on a commercial EV charger.

The attack exploits a proactive SIM command called RUN AT, which allows the SIM to instruct the modem to execute AT commands. This effectively hands the card a general-purpose console. The researchers found the capability in six of eight cellular modules tested, including five Quectel parts, and three phones: OPPO Find X5, OPPO Reno 14 F 5G, and ASUS Zenfone 9. No iPhone or Pixel devices were affected.

The attack requires physical access to insert a malicious SIM card, either directly or via an interposer, or through a compromised operator or supply chain. Unattended IoT devices with accessible SIM trays are particularly at risk. The researchers demonstrated code execution on an Autel EV charger using a Quectel EC25AFXDGA module, exploiting a format string vulnerability in the atfwd_daemon. They also showed that on an OPPO Reno 14 F 5G, the AT+COPS=0,,,0 command could pin the phone to 2G, a downgrade the user cannot undo, enabling fake base station attacks.

The issue is tracked as CVE-2026-57550 (assigned through Qualcomm) and CVD-2026-0122 by the GSMA. Qualcomm has developed a hardened configuration that disables the interface by default, and Quectel has mitigated the file-access flaw but is still working on the interface. No public advisories have been issued, and no exploitation has been reported. The researchers recommend that IoT fleet operators ask their module suppliers whether RUN AT is enabled and can be disabled.