VulnerabilityDeferred

CVE-2025-26412

The SIMCom SIM7600G modem supports an undocumented AT command, which allows an attacker to execute system commands with root permission on the modem.

MEDIUM 6.8EPSS 0.27%

Does this matter?

Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.

Description

The SIMCom SIM7600G modem supports an undocumented AT command, which allows an attacker to execute system commands with root permission on the modem. An attacker needs either physical access or remote shell access to a device that interacts directly with the modem via AT commands.

CVSS 3.1: 6.8 MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.27% probability · 19th percentile
CISA KEV: Not listed
Weakness: CWE-912
Source: 551230f0-3615-47bd-b7cc-93e92e730bbf

References

https://r.sec-consult.com/simcom
http://seclists.org/fulldisclosure/2025/Jun/17

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.