"We have tried to reach out to the vendor through multiple channels (email and LinkedIn) but have not been able to receive any response," SSD Secure Disclosure said in its August 17, 2026 advisory.
The exploit chain assembled by SSD Secure Disclosure
Security researchers at SSD Secure Disclosure published a two-stage exploit chain that, when completed, yields full Android kernel access on devices using Unisoc modem firmware. The chain builds on an earlier March 2026 disclosure of remote code execution (RCE) in the same modem firmware delivered via a malformed SIP video call. To execute the full chain an attacker must first obtain modem-level code execution using that RCE and then trigger a privilege-escalation step during a VoLTE video call on a target who answers the call.
How the modem-level privilege escalation works
SSD’s proof-of-concept writes a full-access configuration to the modem’s ARM Memory Protection Unit (MPU) through coprocessor registers. That configuration maps the entire 32‑bit physical address space as readable, writable, and executable from the modem’s context — including the memory pages where the Android kernel resides. The root cause is a shared physical memory space between the modem processor and the application processor inside the Unisoc system-on-chip (SoC) without a hardware-enforced boundary that prevents modem-context code from modifying kernel memory. Researchers verified kernel-level execution by observing kernel log output showing the injected payload had run.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageConfirmed chipsets, devices, and the attacker model
The flaw is present in the modem firmware shared by at least three Unisoc chipsets named in the advisory: the T606 used in the Motorola E13, the T612 used in the Realme C33, and the T7250 used in the Xiaomi Redmi A5. SSD confirmed the privilege-escalation on a Motorola E13 carrying a February 2025 security patch and on a Xiaomi Redmi A5 with a January 2026 patch. Completing the attack requires an attacker-controlled private 4G cellular network, a software-defined radio and specialized SIM cards (the researchers used an open-source 4G core for their lab setup), and a target who answers an incoming VoLTE video call.
Vendor response, prior research, and patch status
As of the August 17, 2026 advisory, no CVE identifier has been assigned to the privilege-escalation vulnerability, which SSD classifies as CWE-1189, Improper Isolation of Shared Resources on System-on-a-Chip. The August 2026 Android Security Bulletin, published before SSD’s disclosure, does not address this privilege-escalation issue, and there is no UNISOC security bulletin covering it. SSD reported repeated attempts to contact the vendor but received no response.
The advisory references related work: a November 2025 analysis by Kaspersky ICS CERT documented the same architectural condition on a different Unisoc chip (the UIS7862A in vehicle head units), where researchers who gained modem code execution were able to reach and modify the running Android kernel. Kaspersky described one lateral path involving a hidden Direct Memory Access peripheral as a hardware-level issue not fixable through software, while SSD’s MPU-based route is in principle addressable through a firmware change — though Unisoc has not committed to such an update. By contrast, Check Point Research’s coordinated Unisoc modem vulnerability from 2022 (CVE-2022-20210) was patched by Unisoc and distributed through the Android Security Bulletin; SSD’s and the March 2026 disclosures carry no comparable assurance.
What this means for device owners, manufacturers, and security teams
- Device owners: There is no available patch or mitigation at publication. SSD advises device owners to watch for firmware updates from their device manufacturer. A successful attack requires answering a VoLTE video call and the attacker controlling a private 4G network, but the result — kernel compromise — would grant an attacker full control over device software.
- Device manufacturers and Unisoc customers (Motorola, Realme, Xiaomi among them): The advisory identifies a shared-modem firmware vulnerability affecting deployed devices; manufacturers will need to determine whether firmware updates from Unisoc or device-level firmware distribution can remediate the MPU configuration or otherwise enforce hardware isolation.
- Security teams and incident responders: Reproducing the full chain requires specialized cellular infrastructure and SIMs; defenders should monitor for vendor advisories, prioritize firmware integrity checks where possible, and track whether a CVE is assigned and whether Unisoc or device makers issue firmware updates or mitigations.
Unisoc supplies components for devices sold in more than 140 countries, according to the advisory; the potential reach of an unpatched modem-level weakness underscores the operational importance of vendor engagement. SSD’s public disclosure, repeated attempts to contact the vendor, and the absence of an immediate patch leave device owners and their suppliers with a narrow set of options: wait for a firmware update, consider limiting video-call behavior where practical, and watch for further advisories or CVE assignments.
Original story: https://thehackernews.com/2026/08/unisoc-volte-video-call-exploit-chain.html
