9.8Critical
KEV
CVE-2019-16256SIMalliance Toolbox Browser Command Injection Vulnerability
Known exploited — SIMalliance Toolbox Browser Command Injection Vulnerability
CISA confirmed this vulnerability is used in real attacks on 03.11.2021. Remediation deadline for US federal agencies: 03.05.2022.
Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-16256
Description
Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| trustedconnectivityalliance | s@t browser | — |
References and patches
- https://www.adaptivemobile.com/blog/simjacker-next-generation-spying-over-mobile ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16256 US Government Resource
CPE matches (NVD) (1)
cpe:2.3:a:trustedconnectivityalliance:s\@t_browser:-:*:*:*:*:*:*:*