"The final stage was triggered by placing a video call to the target phone."
How a modem flaw reaches the Android kernel
Researchers at SSD Secure Disclosure (SSD), crediting independent security researcher 0x50594d, have published technical research showing that a flaw in UNISOC modem firmware can allow arbitrary code execution with kernel privileges from the modem context. SSD classified the underlying weakness as Improper Isolation of Shared Resources on System-on-a-Chip (SoC), tracked as Common Weakness Enumeration (CWE) 1189. In plain terms: the modem and the Android kernel share memory in a way that allows code running in the modem to reach and modify kernel memory.
SSD demonstrated a full exploit chain in which modem-level code execution was extended into kernel-level execution. The researchers showed that, once an attacker has code execution on the modem, they can disable protections on a Memory Protection Unit (MPU) region. That change grants the modem context access to physical memory, including memory used by the Android kernel, and enables modification or execution of kernel-space payloads.
Exploit chain: from prior RCE to VoLTE-triggered kernel execution
The disclosure links the SSD test to a previously disclosed UNISOC T612 remote code execution (RCE) and then demonstrates how that modem-level execution can be escalated to the kernel. SSD tested the full chain against a Realme C33 running an Android security update from July 2025.
Crucially, the researchers used a Voice over Long-Term Evolution (VoLTE) connection and showed the final stage of the exploit was triggered by placing a video call to the target phone. The report thus traces a concrete path: an initial compromise that yields code execution in the modem context, disabling MPU protections to access physical memory, and then causing kernel-level code execution initiated during a video call.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageDevices named in the disclosure and testing evidence
SSD identified phones using UNISOC chipsets as affected and explicitly named two devices among those listed: the Xiaomi Redmi A5 with a January 1, 2026 security patch, and the Motorola E13 with a February 1, 2025 security patch. SSD also reported successful testing on a Realme C33 with a July 2025 security update.
SSD noted it does not present the listed devices as an exhaustive inventory of affected phones, leaving open the possibility that other UNISOC-based devices share the same vulnerability vector.
Vendor response and remediation status
SSD reported attempting to contact UNISOC through email and LinkedIn. Separately, Infosecurity also contacted UNISOC for comment but had not received a response at the time of writing. The disclosure does not identify any UNISOC vendor firmware update that addresses the flaw.
SSD framed firmware updates from UNISOC and handset manufacturers as the key route to remediation for affected device owners. Until such updates are published and applied, the vulnerability—by design a failure of SoC isolation—remains exploitable in the tested chain when an attacker already achieves modem-level execution.
What this means for technologists, handset manufacturers, and end users
- Technologists and security teams: The flaw demonstrates a specific SoC-level isolation failure (CWE-1189) that allows a modem context with code execution to manipulate MPU protections and access kernel memory. Teams responsible for mobile platform security will need to validate whether their device firmware separates modem and kernel physical memory effectively and whether existing hardening prevents MPU modification from modem code.
- Handset manufacturers and firmware vendors: SSD points to firmware updates from UNISOC and handset makers as the remediation route. Manufacturers should inventory devices using UNISOC chipsets—beyond the models SSD listed—and prioritize firmware work to restore MPU and SoC isolation guarantees where they are missing.
- End users and general public: SSD’s demonstration used a video call over VoLTE as the triggering action for kernel-stage execution. The disclosure leaves firmware updates as the central fix; until vendors publish patches, affected device owners lack a vendor-confirmed mitigation path.
Conclusion
SSD’s research exposes a structural failure at the intersection of modem firmware and SoC design: missing isolation that permits modem-resident code to reach and execute in kernel memory. The team demonstrated a working exploit chain that culminated during a video call, tested on at least one handset (Realme C33) and identifying other devices (Xiaomi Redmi A5, Motorola E13) among those affected. SSD and Infosecurity contacted UNISOC but, as of the disclosure, no vendor firmware update has been identified. The unanswered, concrete question remains whether UNISOC and its handset partners will issue patches and timelines to close the isolation gap SSD has documented.
Original reporting: https://www.infosecurity-magazine.com/news/unisoc-modem-flaw-rce-calls/
