Your EV Charger Trusts Its SIM Card. That Trust Is the Problem
Researchers at the University of Birmingham and Fuzzware showed that a malicious SIM card can hand an attacker code execution inside the cellular modem of an EV charger, industrial router, or telematics unit — no network breach required.
Everyone worries about the network side of cellular IoT: rogue base stations, SS7 abuse, man-in-the-middle attacks on the air interface. Almost nobody worries about the SIM card itself, because it’s a passive little chip that just proves who you are to the carrier. That assumption is wrong, and researchers just proved it in a way that should worry anyone who runs cellular-connected industrial gear.
A SIM card isn’t passive. It’s a tiny computer that can send its own commands to the modem it’s plugged into, using a decades-old mechanism built into the SIM Application Toolkit. Carriers use this legitimately to push configuration updates over the air. But if you control the SIM — because you swapped it, cloned it, or compromised a provisioning system upstream — you can use that same channel to tell the modem to do things its owner never authorized. Researchers from the University of Birmingham and the firm Fuzzware tested this against 26 phones and cellular modules and found the capability was real and exploitable on a meaningful share of them.
Why this matters more in OT than on your phone
On a smartphone, a malicious SIM is bad but the blast radius is usually contained to that device and maybe your data. On industrial equipment, the modem often isn’t a peripheral — it’s load-bearing infrastructure. EV chargers use cellular modules to handle payment, report status to the operator’s backend, and receive firmware updates. Industrial routers use them as the WAN uplink for entire remote sites, sometimes the only uplink. Vehicle telematics units use them to talk to fleet management systems and, in some architectures, sit close to the vehicle’s CAN bus.
When the modem is compromised at this level, you’re not dealing with a network intrusion you can detect with firewall logs or IDS signatures. The attack rides in on the SIM itself, below the application layer most security tooling watches. A malicious or physically substituted SIM can potentially pivot from modem firmware into the host device, depending on how tightly that boundary is implemented — and in a lot of embedded gear, it isn’t implemented tightly at all, because nobody designed for a hostile SIM.
The SIM was designed as a trust anchor. This research treats it as an untrusted peripheral, which is closer to reality for anything deployed in the field.
The supply chain angle nobody’s pricing in
The scarier version of this isn’t a lone attacker swapping SIMs in charging stations, though that’s a real physical-access risk for public EV infrastructure. It’s the supply chain. Cellular connectivity for IoT fleets is frequently managed by third-party MVNOs and provisioning platforms. If any part of that chain is compromised — a provisioning API, a reseller’s back office, a logistics partner handling SIM fulfillment — an attacker could push malicious profiles to devices already deployed in the field, at scale, without ever touching a single charger or router physically.
That’s a fleet-wide compromise vector for asset classes that are exploding in number: EV charging networks, remote industrial telemetry, connected vehicles. Most operators have no visibility into what their SIM provisioning provider is actually doing, and most procurement contracts for cellular connectivity don’t mention SIM-level security at all.
What to actually do about it
There’s no patch for a design flaw in a toolkit that’s been part of the GSM standard since the 1990s. What you can do is reduce exposure. Ask your cellular module and device vendors whether their modem firmware validates or restricts SIM Toolkit commands, and whether the modem-to-host interface enforces any isolation. For fleets with physical access risk — public chargers, roadside cabinets — tamper-evident SIM trays and remote SIM-swap alerting are cheap insurance. For provisioning, treat your MVNO or connectivity platform as part of your attack surface and ask what controls sit between their provisioning system and a SIM profile push to your devices.
Most of all, don’t assume a cellular uplink is a dumb pipe. It’s a computer talking to another computer, and the research says the trust relationship between them has been backwards for years.
Source: https://thehackernews.com/2026/08/a-malicious-sim-card-can-run-attacker.html