Unisoc Modem Exploit Chain Can Give Attackers Full Android Kernel Access
Security researchers at SSD Secure Disclosure have disclosed a two stage exploit chain affecting Unisoc modem firmware that can ultimately give an attacker full access to the Android kernel through a VoLTE video call.
The second stage vulnerability, published on August 17, 2026, is a privilege escalation flaw classified as CWE 1189, Improper Isolation of Shared Resources on a System on Chip. No CVE has been assigned yet, and Unisoc has not released a fix.
The attack begins with a previously disclosed March 2026 remote code execution vulnerability in Unisoc modem firmware, which can be triggered through a specially crafted SIP video call. To complete the attack, the attacker must control a private 4G network and the victim must answer the incoming VoLTE video call.
Affected Devices
The researchers confirmed the issue on devices using several Unisoc chipsets, including:
- Unisoc T606, found in the Motorola E13
- Unisoc T612, found in the Realme C33
- Unisoc T7250, found in the Xiaomi Redmi A5
Testing confirmed kernel level execution on a Motorola E13 with the February 2025 security patch and a Xiaomi Redmi A5 with the January 2026 security patch.
How the Attack Works
After gaining code execution inside the modem, the attacker exploits the shared physical memory architecture between the modem processor and Android application processor.
Researchers were able to configure the modem's ARM Memory Protection Unit to access the entire 32 bit physical address space. This allowed modem level code to read, write, and execute memory containing the Android kernel.
The researchers confirmed successful kernel level code execution by observing their injected payload in the Android kernel logs.
No Patch Available
The August 2026 Android Security Bulletin does not address this vulnerability, and SSD says no corresponding UNISOC security bulletin has been issued.
SSD also reported that it attempted to contact Unisoc through multiple channels, including email and LinkedIn, but received no response.
For now, affected device owners should watch for firmware updates from their device manufacturers. There is currently no publicly available patch or reliable mitigation for the privilege escalation issue.
The disclosure also highlights a broader architectural concern previously documented by Kaspersky ICS CERT involving other Unisoc hardware, where shared physical memory between the modem and application processor could similarly allow attackers with modem code execution to reach the Android kernel.
