{"id":"CVE-2019-16256","kind":"vulnerability","aliases":["CVE-2019-16256"],"related":[],"title":"SIMalliance Toolbox Browser: SIMalliance Toolbox Browser Command Injection Vulnerability","description":"Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.","summary":"SIMalliance Toolbox Browser is a SIM toolkit browser component that contains a command injection flaw. A remote attacker can alter attack messages to retrieve device location and IMEI data or run other attacks.","severity":"critical","cvss":9.8,"epss":0.04949,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"SIMalliance Toolbox Browser","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","mobile-devices","other","sim-toolkit","simalliance"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply updates per vendor instructions; the sources do not name a fixed version.","status":"open","published_at":"2019-09-12T13:15:10+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:41:32+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-23T21:41:32Z","model":"claude-haiku-5-5","output":{"fix":"Apply updates per vendor instructions; the sources do not name a fixed version.","reach":"unknown","impact":"medium","summary":"SIMalliance Toolbox Browser is a SIM toolkit browser component that contains a command injection flaw. A remote attacker can alter attack messages to retrieve device location and IMEI data or run other attacks.","category":"other","who_cares":["simalliance","sim-toolkit","mobile-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote attacker retrieves location and IMEI, possibly runs other attacks","analyst_note":"Listed in CISA KEV as exploited; find vendor advisory and affected/fixed versions for SIMalliance Toolbox Browser and check the NVD record for CVE-2019-16256.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000463,"input_tokens":2858,"output_tokens":355,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Listed in CISA KEV as exploited; find vendor advisory and affected/fixed versions for SIMalliance Toolbox Browser and check the NVD record for CVE-2019-16256.","search":"'-16256':12A,15A '-2019':11A,14A 'aka':69C,104C 'allow':78C 'alter':47B 'attack':45B,48B,60B,80C 'browser':3A,6A,18A,30B,35B,68C,72C 'certain':93C 'command':7A,40B,94C 'compon':36B 'contain':38B 'cve':10A,13A 'data':56B,90C 'devic':22B,52B,63C 'execut':92C 'exploit':19B 'flaw':42B 'imei':55B,85C 'includ':64C 'inform':86C 'inject':8A,41B 'instruct':99C 'locat':53B,83C 'messag':49B,103C 'might':77C 'mobil':21B 'mobile-devic':20B 'remot':44B,79C 'retriev':51B,82C,88C 'run':58B 'samsung':62C 'sim':25B,33B,96C 'sim-toolkit':24B 'simalli':1A,4A,27B,28B,66C 'simalliance':16A 'simjack':105C 'sms':102C 'stk':98C 'toolbox':2A,5A,17A,29B,67C 'toolkit':26B,34B,97C 'uicc':75C 'via':95C 'vulner':9A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-09-12T13:15:10+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-16256","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-16256","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T16:39:50+00:00","note":null},{"source":"epss","external_id":"CVE-2019-16256","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-16256","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-16256","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16256","severity":null,"published_at":"2019-09-12T13:15:10+00:00","modified_at":"2026-06-17T02:22:00+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}