CVE-2025-26412

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The SIMCom SIM7600G modem supports an undocumented AT command, which allows an attacker to execute system commands with root permission on the modem. An attacker needs either physical access or remote shell access to a device that interacts directly with the modem via AT commands.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-912

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-264137.5Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` input is a positive integer anCVE-2025-264169.8In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to rCVE-2025-264174.0In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storageCVE-2025-264187.8In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account toCVE-2025-264193.3In initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic error in the code. This could lead to localCVE-2025-26429.8A vulnerability, which was classified as critical, was found in PHPGurukul Art Gallery Management System 1.0. This affects an unknown part oCVE-2025-264204.4In multiple functions of GrantPermissionsActivity.java , there is a possible way to trick the user into granting the incorrect permission duCVE-2025-264214.0In multiple locations, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of priviCVE-2025-264224.0In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permissionCVE-2025-264236.2In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a missing bounds check. CVE-2025-264244.0In multiple functions of VpnManager.java, there is a possible cross-user data leak due to a logic error in the code. This could lead to locaCVE-2025-264254.0In multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error in the code. This cou
CVE-2025-26412: Medium severity, CVSS 6.8 | Vulnix