Skip to content

Unisoc VoLTE video-call exploit chain: modem RCE to full Android kernel access

Summary

SSD Secure Disclosure (researcher handle 0x50594d) published the second stage of a two-part exploit chain achieving full Android kernel access on Unisoc modem firmware through a VoLTE video call (advisory: August 17, 2026, ssd-disclosure.com/unisoc-t612-lpe/). The chain began in March 2026 with a remote code-execution disclosure in the same firmware via a malformed SIP video call (ssd-disclosure.com/unisoc-t612-rce/). The privilege-escalation flaw is classified CWE-1189 (Improper Isolation of Shared Resources on System-on-a-Chip); no CVE has been assigned and Unisoc has not responded to repeated outreach (email and LinkedIn). Completing the chain requires an attacker-controlled private 4G cellular network and a victim who answers the incoming video call.

Tags

Why this matters

  • Kernel access over the air, no CVE, no vendor. The flaw sits in modem firmware shared by at least three Unisoc chipsets — T606 (Motorola E13), T612 (Realme C33), T7250 (Xiaomi Redmi A5) — and Unisoc (Shanghai, formerly Spreadtrum) has not acknowledged it. Unisoc supplies components to brands sold in 140+ countries, so the exposure surface is broad.
  • The root cause is SoC-level shared physical memory: the modem processor and application processor share physical address space with no hardware-enforced boundary, letting modem-context code modify kernel memory.
  • The LPE is a full MPU re-map: the exploit writes a full-access configuration to the modem's ARM Memory Protection Unit via coprocessor registers, mapping the entire 32-bit physical address space as readable/writable/executable from modem context — including the pages where the Android kernel resides.
  • Confirmed on patched devices: researchers confirmed the LPE on a Motorola E13 with the February 2025 security patch and a Xiaomi Redmi A5 with the January 2026 patch; the August 2026 Android Security Bulletin (published before this disclosure) does not address it.
  • Practical preconditions keep this from being a mass-exploitation vector: attacker-controlled private 4G network + victim answers the video call. But in contested environments (SIM swapping, rogue base stations, targeted physical proximity) the chain is real and the last two hops need no zero-day.

Chain

  1. Stage 1 (March 2026): malformed SIP video call → RCE in Unisoc modem firmware.
  2. Stage 2 (August 17, 2026): from the modem foothold, write full-access configuration to the ARM MPU via coprocessor registers; map the full 32-bit physical address space RWX from modem context.
  3. Result: kernel-level code execution from modem context; researchers observed kernel log output from the injected payload.

Test environment (for defenders reproducing/validating)

  • Open-source 4G core network, software-defined radio for the 4G interface, specialized SIM cards.

Defender actions

  • Device exposure: inventory handsets on affected chipsets (T606 / T612 / T7250 families; confirmed examples Motorola E13, Realme C33, Xiaomi Redmi A5). Treat unpatched modem firmware as a standing risk, not a patchable CVE.
  • VoLTE/SIP hygiene: where feasible, require strong network-side authentication of VoLTE signaling; rogue/attacker-controlled 4G infrastructure is the enabling condition. Monitor for anomalous IMS/SIP registration patterns.
  • No vendor fix available: until Unisoc ships a modem-firmware fix, treat kernel access from modem context as a realistic post-exploitation capability on affected devices.
  • High-value targets: devices held by executives or field personnel in contested regions; the chain needs call answering, so social-engineering lures ("urgent video call from your bank/IT") are the likely delivery vector.
  • Track the advisories: monitor ssd-disclosure.com/unisoc-t612-lpe/ and /unisoc-t612-rce/ for CVE assignment or vendor response; both disclosures carried the same non-response statement.

Confidence and limits

  • Independent researcher disclosure; no CVE assigned; vendor non-responsive as of publication.
  • Confirmation was on two specific devices with specific patch levels; other Unisoc chipset models are "shared firmware" per the advisory but not individually confirmed.
  • No attribution to any threat group; this is a capability disclosure, not a campaign report.

Sources