SECURITY ADVISORY DOSSIER
CVE-2020-8597
CVSS 8.5HIGH
eSIM UICC Remote Profile Provisioning OTA Command Injection
Vulnerability Overview
Insufficient signature verification in SGP.22 eSIM Remote SIM Provisioning (RSP) download protocol enables over-the-air applet installation and subscriber identity cloning.
Affected Telecom Components
⚡ eSIM eUICC ⚡ SGP.22 RSP Gateway ⚡ SIM Toolkit Applet ⚡ SM-DP+ Server
Recommended Mitigation Guidelines
Implement GSMA SAS-SM certified PKI certificates, restrict SCP03 secure channel keys, and audit OTA applet privileges.