ACTIVELY EXPLOITED
CVE-2019-16256: SIMalliance Toolbox Browser Command Injection Vulnerability
| Vendor | SIMalliance |
|---|---|
| Product | Toolbox Browser |
| Actively exploited | Yes |
| Added to CISA KEV | 3 Nov 2021 |
| CISA federal deadline | 3 May 2022 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
SIMalliance Toolbox Browser contains an command injection vulnerability that could allow remote attackers to retrieve location and IMEI information or execute a range of other attacks by modifying the attack message.
SOURCES
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.