Widely used Telit Cinterion modems open to SMS takeover attacks

Kaspersky ICS CERT disclosed eight vulnerabilities in Telit Cinterion cellular modems—most critically CVE-2023-47610, a heap overflow in SUPL message handlers allowing unauthenticated, remote code execution via specially crafted SMS. The flaws affect multiple widely deployed Cinterion models embedded in industrial, healthcare, and telecom equipment, can enable deep modem compromise (RAM/flash manipulation and manufacturer-level code execution), and although some fixes were issued, several vulnerabilities remain unpatched; Kaspersky recommends telecom operator mitigations (disable SMS to devices, private APN) and enforcing application signature verification.