Joy Agwunobi
The National Information Technology Development Agency (NITDA) has issued a security advisory to Nigerians over a critical vulnerability affecting embedded SIM (eSIM) technology, warning that the flaw could expose millions of devices and communications to cyberattacks worldwide.
In a statement, the agency disclosed that the vulnerability could allow attackers to hijack phone numbers, intercept calls and messages, deploy malicious software applets, and even clone eSIM profiles. More than two billion devices globally—including smartphones, tablets, wearables, and Internet of Things (IoT) devices—are believed to be at risk.
According to NITDA, the flaw originates from the use of the GSMA TS.48 Generic Test Profile (versions 6.0 and earlier), a standard widely applied in radio compliance testing of embedded Universal Integrated Circuit Card (eUICC) chips. If exploited, cybercriminals could gain physical or remote access to targeted devices, extract cryptographic keys, or take persistent control of affected systems.
“This vulnerability poses a significant risk to device integrity and user privacy. It could lead to persistent device control and interception of sensitive communications,” the agency warned.
eSIM technology, which eliminates the need for a physical SIM card, was introduced in Nigeria in 2020 through pilot programmes by MTN and 9mobile, with Airtel joining in 2023.
The digital SIMs have grown in popularity for their flexibility and convenience, but NITDA’s latest alert underscores emerging cybersecurity risks tied to their adoption.
To curb the threat, the agency advised device manufacturers and mobile service providers to urgently deploy Kigen OS patches through over-the-air (OTA) updates and migrate to the latest GSMA TS.48 version 7.0 security standard. It also recommended the removal of outdated test profiles that could be exploited for malicious activities.
“The swift application of updated security controls is critical to safeguarding Nigerian users from what could become one of the most far-reaching cybersecurity threats in recent years,” NITDA stressed.
While Nigeria does not yet have official figures on the number of active eSIM users, experts believe adoption is expanding rapidly, particularly among urban smartphone users and businesses deploying IoT devices. The advisory, analysts say, serves as a timely reminder that the country’s growing digital ecosystem must be matched with stronger cybersecurity vigilance and proactive regulatory oversight.
