AI Weekly Malaysia

Researchers from the University of Birmingham and Fuzzware found that a malicious SIM card can execute attacker-chosen code on cellular modems via a 'RUN AT' interface, present in 9 of 26 devices tested. Six of eight cellular modules accepted the command—including five Quectel parts pulled from an EV charger, industrial router, and car telematics unit—while only 3 of 18 phones did (OPPO Find X5, OPPO Reno 14 F 5G, ASUS Zenfone 9). All nine vulnerable devices run Qualcomm communication processors; Qualcomm has built a hardened config that disables the interface by default for future devices, but neither Qualcomm nor Quectel has published a public advisory.

Why: If you ship or operate cellular IoT fleets—EV chargers, industrial routers, telematics—ask your module supplier today whether RUN AT is enabled in the firmware they ship, since there is no central patch and Quectel's vulnerability portal is login-walled. The attack requires physical SIM access, so unattended devices with accessible SIM trays and few other interfaces are the highest-risk targets.