---
id: "CVE-2019-16256"
kind: "vulnerability"
aliases: ["CVE-2019-16256"]
title: "SIMalliance Toolbox Browser: SIMalliance Toolbox Browser Command Injection Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.04949
exploited: true
status: "open"
category: "other"
products: [{"name": "SIMalliance Toolbox Browser", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "mobile-devices", "other", "sim-toolkit", "simalliance"]
not_affected_if: ["unknown"]
published_at: "2019-09-12T13:15:10+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:34+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-16256", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-16256", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16256", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# SIMalliance Toolbox Browser: SIMalliance Toolbox Browser Command Injection Vulnerability

SIMalliance Toolbox Browser is a SIM toolkit browser component that contains a command injection flaw. A remote attacker can alter attack messages to retrieve device location and IMEI data or run other attacks.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SIMalliance Toolbox Browser affected ? fixed ?

## Fix

Apply updates per vendor instructions; the sources do not name a fixed version.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-16256
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-16256
- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-16256

## From the sources

Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_