What’s Vulnerable › Vulnerabilities

CVE-2025-26412: Undocumented Root Shell Access in SIMCom SIM7600G Modem

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-11 · updated 2026-06-17
• Weakness: CWE-912

Description

The SIMCom SIM7600G modem supports an undocumented AT command, which allows an attacker to execute system commands with root permission on the modem. An attacker needs either physical access or remote shell access to a device that interacts directly with the modem via AT commands.

Affected products

• SIMCom SIM7600G Modem: LE20B03SIM7600M21-A

References

• https://r.sec-consult.com/simcom
• http://seclists.org/fulldisclosure/2025/Jun/17

Get alerted when CVE-2025-26412 or the next vulnerability affects your stack