CVE-2025-26412

🗓️ 11 Jun 2025 08:21:31Reported by SEC-VLabType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 53 Views🌐 WEB

Undocumented access in SIM7600G modem allows attacker root command execution via AT commands.

Reporter	Title	Published	Views	Family All 10
BDU FSTEC	The vulnerability of the wireless modem module SIMCom SIM7600G lies in the presence of undocumented configuration commands, allowing a perpetrator to execute arbitrary commands.	6 Jan 202600:00	–	bdu_fstec
Circl	CVE-2025-26412	11 Jun 202509:33	–	circl
CNNVD	SIMCom SIM7600G 安全漏洞	11 Jun 202500:00	–	cnnvd
Cvelist	CVE-2025-26412 Undocumented Root Shell Access in SIMCom SIM7600G Modem	11 Jun 202508:21	–	cvelist
EUVD	EUVD-2025-18087	3 Oct 202520:07	–	euvd
NVD	CVE-2025-26412	11 Jun 202509:15	–	nvd
Packet Storm	📄 SIMCom SIM7600G Modem Undocumented Root Shell Access	18 Jun 202500:00	–	packetstorm
Positive Technologies	PT-2025-25199 · Simcom · Simcom Sim7600G	11 Jun 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-26412	13 Jun 202509:21	–	redhatcve
Vulnrichment	CVE-2025-26412 Undocumented Root Shell Access in SIMCom SIM7600G Modem	11 Jun 202508:21	–	vulnrichment

[
  {
    "defaultStatus": "unknown",
    "product": "SIM7600G Modem",
    "vendor": "SIMCom",
    "versions": [
      {
        "status": "affected",
        "version": "LE20B03SIM7600M21-A"
      }
    ]
  }
]

Source	Link
r	www.r.sec-consult.com/simcom
seclists	www.seclists.org/fulldisclosure/2025/Jun/17

Parameter	Position	Path	Description	CWE
AT+CSHELL="id"	request body	AT+CSHELL	Undocumented AT command that grants root access when executed via modem (POC uses AT+CSHELL to run shell commands).	CWE-912

17 Jun 2026 09:01Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.16.8

EPSS0.00258

SSVC

CWE-912