feel free to curl it, or review the repo https://github.com/MarkBlah/smsofdeath/

01 06 88 80 80 80 00 BE → sent as a data SMS to port 2948

I'm not familiar with WAP Push and how it works, but is it possible to disable it or block that port on a non-rooted phone?

WAP Push is a specially formatted SMS that triggers your phone to download a URL. Unfortunately the vuln here appears to hit at the SMS parsing phase, which I don't think can be turned off easily.