A Hostile SIM Card Can Take Over the Modem in Your Field Device

The Card Everyone Trusts Can Give Orders

In August 2026, researchers from the University of Birmingham and Fuzzware presented CATana, a study of SIM-originating AT commands, at USENIX WOOT ’26. They tested 26 devices and showed that a SIM card built or modified by an attacker can make a cellular modem run code, leak files, drop to 2G, or shut down. They didn’t break the cellular standard to do it. They used a feature written into it.

Most of the exposed devices weren’t phones. They were the cellular modems inside IoT equipment such as EV chargers and industrial routers, the same class of hardware that connects reclosers, RTUs, and meters to private LTE networks. For anyone running a private cellular network, the hostile SIM is one more way to compromise a single device. What matters is what that device can do next.

How the Attack Works

Every SIM card can send instructions to the device it sits in. The cellular standards (3GPP TS 31.111 and ETSI TS 102 223) call these proactive commands. One of them, RUN AT COMMAND, tells the modem to execute AT commands, the low-level instructions engineers use to configure a modem, change network settings, or read device information.

A modem that follows the spec will run what the SIM sends. The researchers call a SIM used this way a “hostile SIM.” Dr. Marius Muench, who led the work with Tomasz Piotr Lisowski and Kristian Covic, said in the University of Birmingham announcement that the attack surface is “explicitly defined in the technical specifications for cellular communication, resulting into ‘specification-compliant’ attacks.”

What the Researchers Found

The team tested 18 smartphones from 10 vendors and 8 IoT modems from 4 vendors. Nine of the 26 devices exposed the SIM AT interface, and the work led to four vulnerabilities.

Phones mostly refused. Only three reported support for RUN AT (the OPPO Find X5, the OPPO Reno 14 F 5G, and the ASUS Zenfone 9), all on Qualcomm chipsets. IoT modems went the other way. Every Quectel modem tested supported it, including ones pulled from an EV charger, an industrial router, and an automotive telematics unit. So did a Sierra Wireless modem used in an AC charging controller.

The IoT modems tested in the study. The top row are modems taken from real IoT devices. The bottom row are standalone modems. Source: Tomasz Piotr Lisowski, Kristian Covic, and Marius Muench, CATana: On the Dangers of SIM-Originating AT Commands, USENIX WOOT 2026 (Figure 2).

The reason is in how these modems are built. Most carry their own small Linux computer inside the module, and that’s where the SIM’s commands get handled. In many devices, that computer is more powerful than the device’s own main processor.

What the researchers demonstrated:

1. The SIM took full control of an EV charger’s modem. On an Autel Maxi US AC W12-L-4G charger with a Quectel EC25 module, a flaw in how the modem handled SIM commands let the researchers run their own code on it.
2. The SIM pulled files off a Quectel modem and sent them out. It used the modem’s own data connection to deliver the files to a server the researchers controlled.
3. The SIM switched off a phone and its modem. On the OPPO Reno 14 F 5G, which accepted 198 AT commands and variants through the SIM, both stayed down until the next reboot.
4. The SIM locked the same phone onto 2G. Airplane mode, disabling the SIM, and changing network settings couldn’t undo it.

No exploitation in the wild has been reported.

How a Hostile SIM Reaches a Device

The paper lists four ways an attacker gets a hostile SIM into a device, and calls all four “relevant and realistic”:

1. Exploiting a software flaw on the SIM itself, as the 2019 Simjacker attacks did
2. Swapping or tampering with the SIM physically
3. Abusing the remote (OTA) platform used to manage SIMs
4. Tampering with cards during manufacturing or distribution

In a utility deployment, SIMs are bought from a SIM vendor, installed by field crews or contractors across hundreds of sites, and often managed through an OTA platform another company runs. A locked cabinet doesn’t protect the card from anyone further up that chain.

From One Device to the Network

The paper is clear that the modem is rarely the end goal. In its words, “hostile SIMs can serve as an entry vector for a full-system compromise beyond solely the device’s modem.” The researchers point to three follow-on risks:

1. A hijacked modem can be a stepping stone into the device’s main system. In one surveyed device, the main firmware had a memory flaw triggered by bad data from the modem.
2. A forced drop to 2G opens the door to fake base stations. 2G has no mutual authentication between the device and the network.
3. Text messages can become a hidden control channel. A hostile SIM can send and receive SMS through the modem to reach attacker infrastructure.

On a private network, there’s a bigger question. A compromised modem holds a trusted connection into your private LTE core. From there, an attacker can try to reach other field devices, scan the network, open remote sessions, or send malformed traffic at the core itself. We saw this pattern in the Poland energy sector attack, where an attacker came in through a cellular router, spent a week scanning the network behind it, and reached a controller that opened the way into a power plant’s SCADA network.

The hostile SIM is a new way in. Lateral movement from one device is the part defenders already know how to watch for.

What Detection Looks Like

Most of these attacks leave no trace in the SIM record. The IMSI still looks valid. What changes is how the device behaves on the network:

1. A field device starts talking to devices it never talked to before. Reclosers and RTUs have narrow, predictable traffic. New peers are a signal.
2. A device scans the network or opens SSH and other remote sessions. A meter or a charger has no reason to do either.
3. A device sends traffic to an unknown external server. File theft through the modem’s own connection shows up here.
4. Malformed or unusual traffic hits the core. Fuzzing, meaning floods of broken requests meant to crash or damage core services, looks nothing like normal device traffic.
5. A SIM shows up in a different device. A known SIM in a new device, or a new SIM in a known router, changes the IMSI-to-IMEI pairing.
6. A device disappears from the network from time to time. Anomaly detection should catch it, even when the device always comes back.

This is why teams running private networks need a device-centric view of the network. The SIM record says a card is registered. It doesn’t say whether the device behind it is still behaving like the device you onboarded.

What Has Been Fixed

The researchers coordinated disclosure with affected vendors so patches were available before publication. According to press coverage of the research, Qualcomm tracked the exposed interface as CVE-2026-57550 and built a configuration that turns it off by default, and the GSMA is tracking the wider issue as CVD-2026-0122. Google fixed a related hostile-SIM issue, which let a SIM open a web page on a locked phone, as CVE-2025-48618 in the December 2025 Android security bulletin.

The paper argues that blocking the command isn’t enough. Vendors should remove the code paths entirely, so a later update can’t bring them back. Field devices often run the same firmware for years, and updating a recloser or an RTU usually means a maintenance window or a truck roll. Until then, the old behavior stays in place.

Actions to Take Now

1. Know which modem and firmware runs in every field device. Without that list, you can’t tell which devices are exposed.
2. Ask your modem vendors whether RUN AT is enabled. Find out whether a hardened configuration exists, and make it a requirement for new devices.
3. Control who can push remote updates to your SIMs. Log every OTA change and review who has access to the platform.
4. Get an alert when a SIM moves to a different device. It should be flagged the same day.
5. Watch for lateral movement from field devices. New peers, scanning, and remote sessions from a device that never needed them are early signs of compromise.
6. Watch the core for malformed traffic. Fuzzing attempts should never reach core services unnoticed.
7. Limit each field device to the systems its job requires. Segmentation on private cellular decides whether a compromised modem stays contained or reaches SCADA.

The Real Lesson

This attack works because the SIM sits inside the trust boundary on almost every network. The standard gave it a direct line to the modem, and most threat models never looked at that line.

The entry point will keep changing. A router with an exposed interface, a tampered SIM, a contractor’s laptop. What stays the same is the moment after: one compromised device trying to reach the next one.

Platforms such as OneLayer identify every device behind a SIM and watch how it behaves, so lateral movement, scanning, and fuzzing from one compromised device show up as alerts before they reach the rest of the network. Read more about vulnerabilities in private 5G/LTE networks, or see how the OneLayer platform secures private cellular networks.