critical9.8Known exploited
CVE-2019-16256
SIMalliance Toolbox Browser Command Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.
Apply updates per vendor instructions.
Impact
Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Trustedconnectivityalliance | S\@T Browser | All versions |