Cinterion EHS5 3G UMTS/HSPA Module Research

Kaspersky researchers analyzed Telit Cinterion EHSx-series modems and discovered multiple security flaws—seven local and one remote—that include a heap-based buffer overflow in the ULP (SUPL) message handling. Using crafted SMS messages and filesystem/MIDlet manipulation, they achieved remote code execution on the modem, activated OTAP, installed a manufacturer-privileged MIDlet, and used the modem foothold to pivot into a truck’s telematics and vehicle ECUs, demonstrating the potential for complete vehicle takeover; vendor disclosure and mitigation recommendations are provided, though some devices may remain unpatchable due to integration constraints.