Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access
Security researchers at SSD Secure Disclosure have published a two-stage exploit chain that achieves full Android kernel access on devices running Unisoc modem firmware through a VoLTE video call, with no fix from the chipset maker.
Intelligence analysis by Llama
The exploit chain requires the attacker to control a private 4G cellular network and the victim to answer the incoming video call. The vulnerability is classified as CWE-1189, Improper Isolation of Shared Resources on System-on-a-Chip, and no CVE identifier has been assigned as of publication.
Imagine you're on a video call with someone, and they can control your phone's modem, which is like a tiny computer inside your phone. They can use this control to get access to the whole phone's operating system, which is like the brain of the phone. This is a big security problem because it means someone could take control of your phone and do bad things with it.
Analysis
Unisoc VoLTE Video Call Exploit Chain: A Detailed Analysis
The recent disclosure by SSD Secure Disclosure of a two-stage exploit chain that achieves full Android kernel access on devices running Unisoc modem firmware through a VoLTE video call has sent shockwaves through the security community. The exploit chain, which requires the attacker to control a private 4G cellular network and the victim to answer the incoming video call, has significant implications for the security of devices running Unisoc modem firmware.
The vulnerability, classified as CWE-1189, Improper Isolation of Shared Resources on System-on-a-Chip, resides in the modem firmware shared by at least three Unisoc chipsets, including the T606 found in the Motorola E13, the T612 found in the Realme C33, and the T7250 found in the Xiaomi Redmi A5. The flaw allows attackers to write a full-access configuration to the modem's ARM Memory Protection Unit through coprocessor registers, mapping the entire 32-bit physical address space as readable, writable, and executable from modem context, including the pages where the Android kernel resides.
The condition making this possible is a shared physical memory space between the modem processor and the application processor within the Unisoc SoC, with no hardware-enforced boundary preventing modem-context code from modifying kernel memory. Researchers confirmed kernel-level code execution on a test device by observing kernel log output showing that the injected payload had run.
The August 2026 Android Security Bulletin, published before this disclosure, does not address the privilege-escalation vulnerability, and no UNISOC security bulletin covers it. A separate UNISOC advisory from October 2025, CVE-2025-31718 (CVSS score: 7.5), describes a modem input-validation flaw on the same chipset family, though it's not clear whether it corresponds to the March 2026 SSD disclosure.
Device owners currently have no available patch or mitigation and should watch for a firmware update from their device manufacturer. The disclosure follows independent research published in November 2025 by Kaspersky ICS CERT, which documented the same architectural condition on a different Unisoc chip, the UIS7862A, found in vehicle head units.
Implications and Recommendations
The exploit chain has significant implications for the security of devices running Unisoc modem firmware. The shared physical memory space between the modem processor and the application processor within the Unisoc SoC, with no hardware-enforced boundary preventing modem-context code from modifying kernel memory, makes it possible for attackers to write a full-access configuration to the modem's ARM Memory Protection Unit through coprocessor registers.
To mitigate this vulnerability, device owners should watch for a firmware update from their device manufacturer. In the meantime, users should be cautious when answering incoming video calls, especially from unknown or untrusted sources.
Conclusion
The recent disclosure by SSD Secure Disclosure of a two-stage exploit chain that achieves full Android kernel access on devices running Unisoc modem firmware through a VoLTE video call has significant implications for the security of devices running Unisoc modem firmware. The exploit chain, which requires the attacker to control a private 4G cellular network and the victim to answer the incoming video call, has been confirmed to work on multiple devices, including the Motorola E13 and the Xiaomi Redmi A5.
The vulnerability, classified as CWE-1189, Improper Isolation of Shared Resources on System-on-a-Chip, resides in the modem firmware shared by at least three Unisoc chipsets. The flaw allows attackers to write a full-access configuration to the modem's ARM Memory Protection Unit through coprocessor registers, mapping the entire 32-bit physical address space as readable, writable, and executable from modem context, including the pages where the Android kernel resides.
The condition making this possible is a shared physical memory space between the modem processor and the application processor within the Unisoc SoC, with no hardware-enforced boundary preventing modem-context code from modifying kernel memory. Researchers confirmed kernel-level code execution on a test device by observing kernel log output showing that the injected payload had run.
Key points
- Security researchers at SSD Secure Disclosure have published a two-stage exploit chain that achieves full Android kernel access on devices running Unisoc modem firmware through a VoLTE video call.
- The exploit chain requires the attacker to control a private 4G cellular network and the victim to answer the incoming video call.
- The vulnerability is classified as CWE-1189, Improper Isolation of Shared Resources on System-on-a-Chip, and no CVE identifier has been assigned as of publication.
- Device owners currently have no available patch or mitigation and should watch for a firmware update from their device manufacturer.
If this vulnerability is addressed through a firmware update, it could prevent attackers from exploiting the shared physical memory space between the modem processor and the application processor within the Unisoc SoC. This could help to mitigate the risk of kernel-level code execution and prevent attackers from gaining access to sensitive information.
The fact that the vulnerability has been confirmed to work on multiple devices, including the Motorola E13 and the Xiaomi Redmi A5, suggests that the problem may be widespread. If a firmware update is not available or is not effective in addressing the vulnerability, it could lead to a significant increase in the risk of kernel-level code execution and data breaches.
