Multiple security flaws existing in Telit Cinterion cellular modems, popularly used in communication networks and IoT devices, have recently been disclosed. The vulnerabilities could allow attackers to execute arbitrary code via SMS or access sensitive information. These risks are further escalated because identifying affected products is challenging due to the fact that these modems are often integrated within other solutions and stacked with products from other vendors. The security issues, which were reported to the vendor in February 2023 and later disclosed in November, include CVE-2023-47610 through CVE-2023-47616, along with another issue that hasn’t yet been registered. The most severe flaw is CVE-2023-47610 (CVSS score: 8.1), a heap overflow problem that affects the modem’s User Plane Location (SUPL) message handlers and allows unauthenticated remote attackers to execute arbitrary code via SMS messages. The SMS messaging interface is present on all modems, and access is possible if the subscriber number of the target modem in the cellular operator’s network is known. Exploiting this vulnerability can give an attacker deep-level access to the modem’s operating system, which could facilitate the manipulation of RAM and flash memory. The other vulnerabilities had lower severity scores but can be exploited to compromise the integrity of MIDlets (java-based applications running within the modems) for the purpose of bypassing digital signature checks and allowing unauthorized code execution with elevated privileges. While the Cinterion EHS5-E series modem is the model these findings stem from, the Cinterion BGS5, EHS5/6/7, PDS5/6/8, ELS61/81, and PLS62 modems have similar hardware and software architectures and therefore are also at risk. CTIX analysts’ mitigation recommendations include organizations disabling non-essential SMS capabilities for impacted devices and employing securely configured private Access Point Names (APNs).