SIM Attack Hijacks Cellular IoT Devices and EV Chargers

Researchers from the University of Birmingham and Fuzzware found a standardized SIM command, RUN AT, exposed on nine of 26 tested devices, including six of eight cellular modules. They achieved code execution on a commercial Autel EV charger. Qualcomm built a hardened configuration disabling the interface by default.