What’s Vulnerable › Vulnerabilities

CVE-2019-16256: SIMalliance Toolbox Browser Command Injection Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2021-11-03
• EPSS: 4.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-09-12 · updated 2026-06-17

Description

Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.

Affected products

• Trustedconnectivityalliance S@T Browser: all versions

References

• https://www.adaptivemobile.com/blog/simjacker-next-generation-spying-over-mobile
• https://www.adaptivemobile.com/blog/simjacker-next-generation-spying-over-mobile
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16256

Get alerted when CVE-2019-16256 or the next vulnerability affects your stack