Widely used modems in industrial IoT devices open to SMS attack

Kaspersky disclosed a set of vulnerabilities in Telit Cinterion cellular modems — including a critical heap overflow (CVE-2023-47610) in SUPL handlers — that allow unauthenticated remote code execution via specially crafted SMS messages. Affected modules are widely embedded across industrial, healthcare, and telecom systems; some fixes have been issued but others remain unpatched, and mitigations include disabling SMS to devices, using private APNs, enforcing application signature checks, and preventing physical access.