CVE-2019-16256

critical · 9.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply updates per vendor instructions.

Added 2021-11-03Remediation due 2022-05-03

Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.

9.8

CVSS

4.9%

EPSS (exploit prob.)

92nd

EPSS percentile

2019-09-12

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Affected versions
trustedconnectivityalliance	s@t_browser	all versions

Check a specific version with /api/v1/cve/match.

References

https://www.adaptivemobile.com/blog/simjacker-next-generation-spying-over-mobile
https://www.adaptivemobile.com/blog/simjacker-next-generation-spying-over-mobile
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16256

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2019-16256