SIMalliance · Toolbox Browser

CVE-2019-16256

SIMalliance Toolbox Browser Command Injection Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 4.9%

What it is

Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.

CISA: SIMalliance Toolbox Browser contains an command injection vulnerability that could allow remote attackers to retrieve location and IMEI information or execute a range of other attacks by modifying the attack message.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: May 3, 2022

Added to the CISA list: November 3, 2021
Published: September 12, 2019
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 4.9% in the top 7.9% of all known vulnerabilities
More details: NVD · CVE.org · CISA

All references (1)

https://www.adaptivemobile.com/blog/simjacker-next-generation-spying-over-mobile

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.