Critical severity · published Sep 12, 2019
CVE-2019-16256
SIMalliance Toolbox Browser Command Injection Vulnerability
In wildKEV
9.8
CVSS
4.9%
EPSS
Yes
On KEV
Description
Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.9% · higher than 92% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueMay 3, 2022
Ransomware campaign useNot known
Affected products
Which versions
SB
S@t Browser · Trustedconnectivityalliance
All versions, or not specified · source: NVD
TB
Toolbox Browser · SIMalliance
All versions, or not specified · source: KEV