Security researchers have uncovered a significant vulnerability in Unisoc modem firmware that enables attackers to gain full access to the Android kernel. This exploit can be executed through a VoLTE video call and remains unpatched by the chipset manufacturer, posing a substantial risk to affected devices.
Details of the Vulnerability
The security advisory, made public on August 17, 2026, by SSD Secure Disclosure, outlines a two-stage exploit chain. The initial stage, disclosed in March 2026, involves remote code execution via a malformed SIP video call. For successful exploitation, attackers must control a private 4G network and the victim must answer the video call.
SSD Secure Disclosure has attempted to communicate with Unisoc through various channels but has not received any response. The vulnerability is identified as CWE-1189, which involves the improper isolation of shared resources within the System-on-a-Chip (SoC). Notably, no CVE identifier has been issued for this flaw at the time of publication.
Impact on Devices
The vulnerability affects modem firmware used in several Unisoc chipsets, including the T606, T612, and T7250, which are found in popular devices like the Motorola E13, Realme C33, and Xiaomi Redmi A5. These chipsets are prevalent in devices sold by major brands across over 140 countries.
Testing confirmed the vulnerability on devices with recent security patches, highlighting the need for a patch from manufacturers. The exploit requires a foothold gained from the March 2026 remote code execution vulnerability, along with control over the VoLTE infrastructure.
Technical Analysis
Researchers utilized an open-source 4G core network and specialized SIM cards to demonstrate the exploit. The exploit works by writing a full-access configuration to the modem’s Memory Protection Unit, allowing read, write, and execute permissions across the entire physical address space, including the Android kernel.
This vulnerability arises from a shared physical memory space between the modem and application processors within Unisoc’s SoC, lacking hardware-enforced boundaries. This flaw allows modem-context code to alter kernel memory, confirmed through kernel log analysis.
Despite its critical nature, the August 2026 Android Security Bulletin and UNISOC advisories have not addressed this vulnerability. Previous research by Kaspersky ICS CERT on a similar architectural condition in a different Unisoc chip underlines the challenge in mitigating such hardware-level issues.
Device owners are advised to remain vigilant for any firmware updates from manufacturers, as no current mitigation is available. The situation underscores the ongoing risks associated with embedded chipset vulnerabilities and the urgent need for coordinated security measures.
