Potentially Millions of IoT Devices Exposed by Flaws in Integrated Telit Cinterion Modems

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

Seven vulnerabilities reported in Telit Cinterion cellular modems could expose embedded devices used in industrial equipment, smart meters, telematics, vehicle trackers, healthcare systems and other connected products. The most serious, CVE-2023-47610, was described as an unauthenticated remote-code-execution flaw triggered by specially crafted SMS messages.

“Potentially millions” is the accurate description—not a confirmed count of vulnerable devices. Because these modems are hidden inside products made by other companies, researchers could not establish the exact number of affected vendors or end products.

#	Preview	Product	Price
1		Telit LE910-NAG MiniPCIe Modem Module - 4G/LTE + GPS - 100 x 50 Mbps	$29.95	Buy on Amazon

What is actually vulnerable?

This is not a flaw in “the IoT” as a single platform. The issue concerns specific Telit Cinterion modem families, firmware versions, protocols and configurations. Risk also depends on how each modem is integrated into its host product.

Organizations should distinguish between:

• the Cinterion modem module;
• firmware running on that module;
• the finished IoT product;
• the product’s operating system and application;
• the cellular carrier and APN; and
• the private or enterprise network connected to the device.

A product may contain an affected modem without having the same practical exposure as another product. Firmware revision, SMS configuration, host-device interfaces, carrier filtering and OEM compensating controls all matter.

#1 Best Overall

Telit LE910-NAG MiniPCIe Modem Module - 4G/LTE + GPS - 100 x 50 Mbps

• Brand New Stock - Part Number: LE910NAG703T701
• Supports 2G, 3G, 4G Bands B2, B4, B5, B17 -- AT&T, T-Mobile, Canadian GSM
• Embedded GPS/GLONASS Receiver
• Rx Diversity, 2x2 MIMO and GNSS Antenna Connectors
• Firmware 17.00.503 Installed

$29.95

Buy on Amazon

The seven reported vulnerabilities

The reported CVE range is:

• CVE-2023-47610
• CVE-2023-47611
• CVE-2023-47612
• CVE-2023-47613
• CVE-2023-47614
• CVE-2023-47615
• CVE-2023-47616

CVE-2023-47610 was identified as the most severe issue. Reporting described it as a memory heap-overflow vulnerability that could permit unauthenticated remote code execution through SMS on affected configurations.

The other six vulnerabilities concern the handling of Java applets. Reported effects include signature-check bypass, unauthorized code execution and privilege escalation. They do not necessarily have the same exploit path or access requirements; some were described as requiring local access.

How an SMS message can become an attack path

1. An attacker sends a specially crafted SMS message to a vulnerable modem.
2. A flaw in the modem’s handling of a location-based-services protocol can cause memory corruption.
3. If exploitation succeeds, the attacker may execute arbitrary code without authentication.
4. The attacker may then manipulate modem RAM or flash memory.
5. Depending on the product architecture, the result could affect connectivity, telemetry, device integrity or the connected operational environment.

That does not mean every product containing the modem can be fully taken over. Code execution on a modem is distinct from compromise of the host processor, operating system, enterprise network or physical process. The consequences depend on separation between components, available interfaces, privileges and the design of the finished product.

“Remote” also does not necessarily mean reachable from the public internet. The attack path uses cellular messaging, so practical reachability depends on whether SMS is provisioned, how the carrier handles messages and whether device or enterprise controls filter them.

Why SMS matters

SMS is often treated as a provisioning, control or support channel rather than as a conventional internet-facing service. A cellular device may therefore receive messages even when its operator does not consider it publicly exposed.

Kaspersky reportedly characterized disabling SMS as the only reliable mitigation for the CVE-2023-47610 attack path at the time of disclosure. That recommendation should be applied only after checking the product’s requirements and current OEM guidance. Some devices rely on SMS for alarms, provisioning or operational workflows.

Which products may contain affected modems?

The reported deployment categories include:

• industrial equipment and operational technology;
• smart meters and utility infrastructure;
• telematics and vehicle-tracking systems;
• automotive equipment;
• healthcare and medical devices;
• telecommunications equipment; and
• financial-services infrastructure.

These are examples, not a confirmed list of affected products. The modem may be purchased by an equipment manufacturer, integrated into a gateway or meter, and sold under an entirely different brand. Finished-product documentation may not mention the module at all.

Why the number of affected devices is uncertain

The original report, published on May 10, 2024, said researchers could not determine the exact number of affected IoT vendors or products. The “millions” figure is therefore a potential-impact estimate based on the broad deployment of embedded cellular modems, not a verified inventory.

Inventory is complicated by multiple supply-chain layers:

1. Telit Cinterion supplies the modem.
2. A distributor or integrator may package or configure it.
3. A product OEM incorporates it into finished equipment.
4. A systems integrator deploys the equipment.
5. A carrier provides cellular connectivity.
6. The asset owner operates the final device.

Each layer may hold only part of the information needed to identify the exact module, hardware revision and firmware branch.

What organizations should do now

1. Search for the embedded component

Review procurement records, bills of materials, device labels, firmware manifests and OEM advisories for:

• Telit or Cinterion branding;
• the exact modem family and module number;
• firmware and hardware revisions;
• product SKU and serial-number ranges;
• the cellular carrier and APN; and
• whether SMS is provisioned or required.

Do not rely only on IP or MAC-address discovery. The modem may be a subordinate component behind the host product and invisible to ordinary enterprise scanning.

2. Ask both vendors for product-specific answers

Contact the finished-product OEM as well as Telit Cinterion. Ask:

• Does this product use an affected modem?
• Which exact firmware versions are vulnerable?
• Can the modem be updated independently?
• Does updating require a host-device update?
• Is remote firmware updating supported?
• Is SMS disabled by default or filtered?
• Does the product use Java applets?
• Which remediation applies if the device cannot be patched?

The original coverage reported that some flaws had been patched but not all at publication time in 2024. That is historical information, not confirmation of the current 2026 status. Patch availability must be verified for the exact product and firmware branch.

3. Reduce exposure where safe

• Disable inbound and other nonessential SMS capabilities.
• Ask the carrier whether unsolicited or nonessential SMS can be blocked.
• Use a private APN with restrictive routing and security settings.
• Separate cellular-connected devices from critical control networks.
• Limit modem-management interfaces to required systems.
• Monitor unusual SMS activity, unexplained resets and abnormal connectivity.
• Preserve relevant logs before changing firmware or configuration.

A private APN can constrain network routing, but it may not prevent a malicious SMS from reaching the modem. Carrier filtering is an additional control, not a substitute for patching or disabling unnecessary SMS.

4. Patch cautiously

Firmware updates to remote industrial, utility, automotive or medical equipment can create availability and safety risks. Before updating, establish a maintenance window, rollback procedure, out-of-band access path, validated image, staging device and recovery plan.

Confirm that the update covers the modem firmware—not merely the host application. Also check whether the process reboots the equipment, resets modem configuration, requires a factory reset or affects carrier certification.

5. Replace unsupported hardware when necessary

Replacement may be required when a module is end-of-life, the OEM no longer supports it or no safe update path exists. However, swapping a modem is not automatically straightforward. It may require physical access, carrier recertification, new integration testing and changes to the host product.

For unsupported devices, prioritize carrier filtering, network isolation, removal of unnecessary SMS dependencies, enhanced monitoring and a documented replacement schedule. A generic firewall cannot fully address a vulnerability inside a cellular modem.

Special considerations for safety-critical devices

Medical equipment, transportation systems, utilities and industrial-control environments require coordination among security, safety, engineering, regulatory and maintenance teams. Disabling SMS immediately may be inappropriate if the channel supports an alarm or safety function.

In those cases, first determine whether SMS is essential, implement an approved alternative where possible, apply the OEM’s validated remediation and test the change under controlled conditions.

Who is responsible for fixing the problem?

Responsibility is usually shared. Telit Cinterion may provide modem firmware or technical guidance, but the product OEM often controls whether that firmware can be safely delivered to the finished device. Integrators may control deployment, carriers may provide SMS filtering or APN controls, and operators remain responsible for applying updates and configuration changes.

This division explains why a CVE search may not reveal every affected product and why a modem vendor’s patch does not automatically mean that every deployed device is fixed.

What the disclosure does not prove

• It does not prove that millions of devices were actively exploited.
• It does not mean every Telit Cinterion modem is vulnerable.
• It does not mean every product containing an affected modem can be fully taken over.
• It does not establish that the flaws are being exploited in the wild.
• It does not make a private APN a complete solution.

The accurate conclusion is narrower but still serious: researchers identified seven vulnerabilities in widely deployed embedded cellular modems, including a potentially remotely exploitable SMS attack path. The actual exposure of any organization depends on its modem model, firmware, configuration, product architecture and vendor support status.

Quick Recap

Bestseller No. 1

Telit LE910-NAG MiniPCIe Modem Module - 4G/LTE + GPS - 100 x 50 Mbps

Brand New Stock - Part Number: LE910NAG703T701; Supports 2G, 3G, 4G Bands B2, B4, B5, B17 -- AT&T, T-Mobile, Canadian GSM

$29.95

Operator checklist

• Do our products contain a Telit Cinterion modem?
• What are the exact module, hardware and firmware versions?
• Is inbound SMS required for normal operation?
• Can the carrier filter or block unsolicited SMS?
• Is the APN private, and is routing restricted?
• Is the modem isolated from critical host and control networks?
• Does the OEM provide a validated modem update?
• What is our replacement plan for unsupported equipment?

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.