VULNERABILITY INTELLIGENCE

CVE-2019-16256

CVSS score9.8 CRITICAL

EPSS probability4.95%

CISA KEVKnown exploited vulnerability

Published2019-09-12

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

SIMalliance Toolbox Browser Command Injection Vulnerability

Vendor / product: SIMalliance / Toolbox Browser

Description

Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.

Primary references

cve@mitre.org — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource