RUN AT command enables hostile SIM takeover in 6 of 8 Quectel cellular modules

The attack begins with physical or supply-chain insertion of a hostile SIM that issues the standardized proactive RUN AT command. On affected Qualcomm-based modules the command reaches an atfwd_daemon running on a Linux application processor, granting the card a full modem console. Researchers executed the path on a commercial Autel MAXI US AC W12-L-4G charger without any network interaction or prior knowledge of the victim’s MSISDN.

Testing covered 18 handsets and eight M2M modules; only the Quectel EC25, EC21, BG96, EG25 and one additional variant accepted the command. Five of the six vulnerable modules were recovered from deployed IoT hardware. No iPhone, Pixel or Samsung device was affected, indicating vendor-specific hardening of the proactive command interface.

The exposure is architectural rather than a single bug: 3GPP specifications explicitly define SIM proactive commands, and Qualcomm’s default configuration leaves the interface open for M2M firmware. Quectel has claimed mitigation for file-access flaws but has not published an advisory or confirmed removal of RUN AT code paths.

Fleet operators can query suppliers today for firmware builds with the interface disabled; future Qualcomm reference designs will ship hardened by default. No in-the-wild exploitation has been reported, yet the requirement for only a swapped card makes unattended industrial and automotive devices high-value targets.