Unisoc Modem Flaw Turns Video Call Into Android Kernel Takeover: No Patch, No CVE

Security researchers published proof-of-concept code Sunday showing that answering a video call can hand a remote attacker complete control of the Android kernel on budget smartphones running Unisoc chipsets — the processors inside hundreds of millions of devices sold under the Motorola, Realme, and Xiaomi brands. Five months after the first stage of the exploit was disclosed, the chipmaker has not responded to a single outreach attempt, issued any patch, or acknowledged the vulnerabilities. The SSD Secure Disclosure advisory confirms both of these facts directly.

The advisory, published August 17 by SSD Secure Disclosure, is the second half of an exploit chain built by an independent researcher operating under the handle 0x50594d. Together, the two stages allow an attacker who controls a rogue 4G cellular network to first plant shellcode in the target phone's modem processor, then trigger its execution — and escalate from modem code to unrestricted kernel write access — simply by placing a video call that the victim answers. The advisory documents the full chain including proof-of-concept code, ARM assembly shellcode, and detailed exploit infrastructure.

To understand why this matters, it helps to understand the architecture it breaks.

Every modern smartphone contains two separate processors sharing a single chip: an applications processor (AP), which runs Android and all user apps, and a modem processor, which handles cellular radio communications. The security model assumes these two domains are isolated. Code running on the modem should not be able to read or write the memory where Android's kernel lives. That assumption is the entire foundation on which a user trusting their phone's apps and data rests.

On Unisoc's T606, T612, and T7250 chipsets — and closely related silicon including the T616 — no hardware-enforced isolation separates those two domains. The modem processor and the applications processor the same physical memory space. The only barrier is the ARM Memory Protection Unit (MPU), a configurable hardware register that tells the modem what memory regions it is allowed to touch. And 0x50594d found that the MPU's protection can be disabled in modem-context code by writing four ARM coprocessor instructions — a sequence that takes the entire 32-bit physical address space and marks it readable, writable, and executable from modem context. The Android kernel sits in that space. Both facts are documented in the SSD Secure Disclosure technical advisory .

The vulnerability class is designated CWE-1189 by MITRE — Improper Isolation of Shared Resources on System-on-a-Chip — and describes exactly this condition: hardware components sharing a chip's address space without adequate isolation enforced between them.

The chain works in two stages that must be staged in order.

In March 2026, SSD published Stage 1: a remote code execution vulnerability in the Unisoc T612 modem's handling of SIP/SDP messages — the signaling protocol packets that set up VoLTE (Voice over LTE) video calls — documented in the Stage 1 advisory . Voice over LTE is the technology underlying most video calls made over a 4G cellular network today. Before a call connects, the two devices exchange SIP INVITE messages whose bodies carry SDP — Session Description Protocol — content describing the media format. The Unisoc modem must parse that SDP content. By crafting malformed SDP bodies in a sequence of INVITE messages, 0x50594d found a way to corrupt the modem's memory and execute arbitrary code on the modem processor before any call is answered.

Stage 2, published August 17, escalates that modem foothold to the Android kernel. The attacker pre-loads shellcode fragments into the modem's heap memory across multiple malformed INVITE messages, with each fragment stored in 0x4b0-byte chunks separated by gaps. When the victim answers an incoming video call, an egg-hunter shellcode activates: it scans modem memory, locates and reassembles the fragmented payload at a fixed address, and executes it. That payload writes a full-access MPU configuration to ARM coprocessor registers through MCR p15 instructions, mapping address 0x00000000 through 0x100000000 as unrestricted from modem context.

The Android kernel, sitting at physical address 0x80080000, is now writable by the attacker's code. In the researchers' proof of concept, the kernel shellcode simply called printk("Exploit worked!") — but at kernel privilege, an attacker can install persistent malware, extract credentials, read banking app data, activate the microphone or camera, or wipe the device. All of this is documented in the SSD's published PoC advisory .

The complete attack chain carries real operational prerequisites. An attacker needs control of a 4G cellular network the victim is connected to — not a commercial carrier, but a rogue network they operate themselves. In their proof of concept, SSD researchers built one using Open5GS (an open-source 4G core network), a LimeSDR software-defined radio for the 4G radio interface, and programmable Osmocom SIM cards. All of these components are commercially available.

The attacker's own phone registers to the network exactly as a standard device would. And once the victim is connected to the rogue network and answers the video call, Dark Reading confirmed any smartphone on the attacker's side can trigger the final stage — no specialized hardware is required at that point.

SSD has not confirmed whether the chain works over real carrier networks without modification. Rogue 4G deployments are within the capability of nation-state actors and sophisticated criminal organizations; they are well outside the reach of casual attackers.

SSD confirmed the privilege escalation on two specific devices: a Motorola E13 running a February 2025 security patch and a Xiaomi Redmi A5 carrying a January 2026 patch. The Realme C33 was the primary victim device used throughout the Stage 2 proof of concept. The vulnerability resides in the modem firmware of the Unisoc T606 (Motorola E13), T612 (Realme C33), and T7250 (Xiaomi Redmi A5) chipsets — and separately reported findings suggest the T616, a close relative of the T612, is also in scope. Further details on affected devices appear in Infosecurity Magazine's coverage of the advisory.

The significance of the affected patch levels cannot be overstated: the Xiaomi Redmi A5 used in testing carried a January 2026 Android security patch — meaning a device that received an Android security update just seven months ago remains fully vulnerable. Android security updates and modem firmware updates are separate. A phone current on Android patches may be running modem firmware that has never been updated at all.

Unisoc supplies chipsets to brands including Honor, Realme, vivo, Samsung, and Motorola, with products distributed across more than 140 countries. The company holds approximately 14% of the global smartphone SoC market as of the first half of 2026, according to Counterpoint Research data, with its strongest concentration in the sub-$150 segment that defines handset access for hundreds of millions of users in Asia, Africa, and Latin America.

What makes this disclosure particularly alarming is not just the vulnerability — it is the non-response.

SSD's March 2026 Stage 1 advisory carried the same statement that appeared in August: the researchers had tried to reach Unisoc through email and and received nothing back. The company had five months to acknowledge the disclosure, assign a CVE, begin work on a firmware fix, or alert device manufacturers. It appears to have done none of these things.

The contrast with the company's own history is sharp. When Check Point Research disclosed CVE-2022-20210 — a different Unisoc modem flaw, a denial-of-service bug rather than full kernel access — Unisoc patched it and the fix was distributed through the Android Security Bulletin. That historical example, documented by The Hacker News , shows Unisoc is capable of coordinating disclosure and shipping patches. Its silence on these two vulnerabilities is a choice, not a technical limitation.

No CVE identifier has been assigned to either the Stage 1 or Stage 2 vulnerability. That absence has operational consequences: enterprise vulnerability management tools that rely on CVE identifiers to track and prioritize patches cannot flag these vulnerabilities for corporate or government device fleets running Unisoc hardware.

A separate Unisoc advisory from October 2025, CVE-2025-31718, covers a modem input-validation flaw on the same chipset family with a CVSS score of 7.5. It is not clear whether that advisory corresponds to the March 2026 SSD disclosure.

The shared-memory design at the root of this exploit is not unique to the devices in this advisory, and this is not the first time researchers have found it.

In November 2025, Kaspersky ICS CERT published its Unisoc UIS7862A vehicle research , documenting the same architectural condition on a different Unisoc chip — the UIS7862A, found in the head units of Chinese-manufactured vehicles. After gaining modem code execution through a separate vulnerability — a stack-based buffer overflow in the 3G Radio Link Control (RLC) protocol — the Kaspersky team was able to reach and modify the running Android kernel by exploiting the same modem-to-AP shared physical address space. Evgeny Goncharov, head of Kaspersky ICS CERT, noted in a related press release that "SoC security is a complex issue" and warned that "certain limitations cannot be completely resolved through software updates alone."

Specifically, Kaspersky described one of its lateral movement paths — exploiting a hidden Direct Memory Access (DMA) peripheral to reach kernel memory — as a hardware-level issue not correctable by firmware update. The Memory Protection Unit route used in the SSD chain is different: it is in principle fixable through a firmware change that prevents modem-context code from reconfiguring MPU region 0. But that fix requires Unisoc to ship updated firmware, and device manufacturers to push it to millions of already-sold handsets — a distribution challenge that has historically proven difficult in the sub-$150 Android market, where over-the-air update infrastructure is least reliable and commercial incentives to update sold devices are weakest.

The broader modem attack surface pattern is well-documented beyond Unisoc specifically. Google's Project Zero previously demonstrated multiple vulnerabilities in Samsung's Exynos modems that enabled full device compromise from a phone number alone, with no user interaction required. The common thread is that modem firmware — complex, proprietary, poorly understood outside chipmaker security teams — processes attacker-controlled data from the network before Android's security model can intervene.

The honest assessment is split. The MPU route the SSD chain uses is, in principle, correctable through a firmware update that prevents modem-context code from reconfiguring MPU region 0. If Unisoc ships that update, device manufacturers would need to integrate it into their firmware release and push it to affected handsets.

The DMA path that Kaspersky separately documented on the UIS7862A is potentially a hardware-level issue — not addressable by firmware at all.

Both conclusions a harder structural problem. Budget Android devices in emerging markets frequently receive security updates for only twelve to eighteen months after sale, if at all. A sub-$150 phone running a Unisoc chipset sold in India, Nigeria, or Indonesia in 2024 may never receive a modem firmware update regardless of whether Unisoc produces one, because the device manufacturer has no commercial incentive to maintain update infrastructure for devices that have already been paid for. The absence of a CVE compounds this: without a CVE, there is no standard mechanism for enterprises, governments, or mobile carriers to be automatically alerted that their device fleet carries an unpatched kernel-level vulnerability.

The options are limited, because this is a modem-level vulnerability that operates beneath the Android security layer.

There is no setting to toggle, no app to install, and no workaround that definitively blocks the attack short of not connecting to untrusted 4G networks. Users on commercial carrier networks face a lower practical risk than users who connect to open or unknown 4G infrastructure, but the threat model depends on the sophistication and geographic proximity of potential attackers.

The modem sits below Android's update system. Even a device current on Android security patches may be running modem firmware from the device's launch date. Until Unisoc ships a fix and device manufacturers push it, millions of people carry phones that can be fully compromised by answering a video call on the wrong network.

Devices confirmed vulnerable by SSD Secure Disclosure include the Motorola E13 (Unisoc T606 chipset), Realme C33 (T612), and Xiaomi Redmi A5 (T7250). Devices running the closely related T616 chipset are also reported as in scope. Unisoc supplies chipsets to a broad range of budget Android brands including Honor, Realme, vivo, and Motorola, making the potential exposure difficult to bound precisely without a full chipset audit. If your phone was purchased under $150 from one of these brands and you are uncertain of its chipset, the device model number alongside "Unisoc" or check the device's specifications on the manufacturer's website.

Yes, with conditions. Researchers demonstrated the full chain working in a controlled environment using a rogue 4G network they built with commercially available hardware. The attack requires the attacker to control the 4G network the victim connects to and to have pre-staged the modem payload. This is not a casual attack — it requires significant technical capability and infrastructure, placing it currently within the range of nation-state actors and sophisticated criminal organizations rather than opportunistic hackers. If and when the technique is refined or commoditized, the barrier could fall.

As of August 18, 2026, no patch exists from Unisoc for either the Stage 1 remote code execution (disclosed March 2026) or the Stage 2 privilege escalation (disclosed August 17, 2026). No CVE identifiers have been assigned to either flaw, meaning automated patch management tools cannot flag the issue. The only available action is to watch for firmware updates from your device manufacturer and apply them as soon as they appear. Declining video calls from unknown numbers over cellular networks reduces exposure but does not eliminate the underlying vulnerability.

The Android security bulletin and modem firmware are separate update tracks. Android security updates patch vulnerabilities in the operating system and application layer; modem firmware updates patch the chipset's radio software. A device can be fully current on Android security patches while running modem firmware that is months or years old and contains unpatched critical flaws. This is the condition documented here: the Xiaomi Redmi A5 tested by SSD carried a January 2026 Android security patch — seven months old — and remained fully vulnerable to this attack. The modem operates beneath the Android security model and is not covered by the monthly security bulletin.