Unisoc Modems: A VoLTE Attack Chain Can Reach the Android Kernel

From a SIP Call to Full Device Control

SSD Secure Disclosure published the second stage of an attack chain on August 17, 2026, showing how an attacker can move from a Unisoc modem to kernel-level code execution on Android.

The chain begins with a vulnerability disclosed in March 2026. An attacker can achieve remote code execution in the modem through a specially crafted SIP video call. The new research demonstrates how that initial foothold can be turned into a compromise of the entire operating system.

The attack requires specific conditions:

• a private 4G cellular network controlled by the attacker;
• exploitation of the modem’s RCE vulnerability;
• a video VoLTE call prepared by the attacker;
• the victim answering the incoming call.

The independent researcher who conducted the analysis uses the handle 0x50594d. SSD says it unsuccessfully attempted to contact Unisoc by email and LinkedIn, a difficulty already reported in the previous disclosure.

Insufficient Isolation Between the Modem and Application Processor

The privilege-escalation vulnerability is classified as CWE-1189, “Improper Isolation of Shared Resources on a System-on-a-Chip.” It had no CVE identifier at the time of publication.

The issue stems from the architecture of certain Unisoc SoCs. The modem processor and application processor share the same physical memory space; the hardware therefore does not enforce a sufficient barrier to prevent modem code from accessing memory used by the Android system.

After gaining code execution in the modem, the attacker modifies the configuration of the ARM Memory Protection Unit by altering coprocessor registers. This maps the entire 32-bit physical address space with read, write, and execute permissions.

The reachable regions include pages containing the Android kernel. Code running in the modem can therefore directly modify kernel structures and instructions, bypassing the normal isolation between device components.

To validate the result, the researchers built an open-source 4G core network, a software-defined radio, and specialized SIM cards. Kernel-level payload execution was confirmed in the device’s kernel logs.

This is therefore more than control of the modem. The potential impact includes privileged control of the Android system, with capabilities exceeding those of a compromise limited to cellular functions.

Verified Chipsets and Smartphones

The flaw resides in modem firmware shared by at least three chipsets:

• Unisoc T606, used in the Motorola E13;
• Unisoc T612, used in the Realme C33;
• Unisoc T7250, used in the Xiaomi Redmi A5.

Unisoc, formerly known as Spreadtrum, supplies components to several manufacturers, including Motorola, Realme, and Xiaomi. According to the advisory, affected devices are sold in more than 140 countries.

The escalation was verified on two specific configurations:

• a Motorola E13 running the February 2025 security update;
• a Xiaomi Redmi A5 running the January 2026 security update.

Testing these versions does not automatically establish which other models or firmware versions are vulnerable. The full list of affected devices is unknown.

No Patches and Related Vulnerabilities

The August 2026 Android Security Bulletin does not address the escalation described here. No Unisoc security bulletin dedicated to the issue appears to be available either.

At the time of disclosure, no corrective firmware update had been announced. No patches or operational mitigations that owners can apply directly are known.

A separate Unisoc advisory published in October 2025 describes CVE-2025-31718, an input-validation vulnerability in the modem of the same chipset family. The issue has a CVSS score of 7.5, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

It has not been established whether CVE-2025-31718 is the same as the RCE vulnerability publicly disclosed by SSD in March 2026. The two flaws should therefore not be treated as identical.

This research follows an independent study by Kaspersky ICS CERT, published in November 2025, involving the Unisoc UIS7862A chipset used in automotive head units. In that case, researchers were also able to reach and modify the Android kernel through shared physical memory after gaining access to the modem.

Kaspersky also identified a lateral-movement path involving a hidden DMA peripheral, which was considered a hardware issue that could not be fixed with a simple software update. SSD’s method instead abuses the Memory Protection Unit and, in principle, can be corrected through firmware.

A separate earlier case is CVE-2022-20210, a Unisoc vulnerability with a CVSS score of 9.8 that was fixed by the manufacturer and distributed through the Android Security Bulletin. No equivalent guarantee exists for vulnerabilities disclosed in 2026.

What Users and Administrators Can Do

No confirmed technical workarounds are available to disable the flaw or isolate the modem. Users of affected models should therefore regularly check for updates from Motorola, Realme, and Xiaomi, verifying both the Android version and security patch level.

The chain nevertheless requires several non-trivial conditions. The attacker must control a compatible private 4G network, successfully exploit the initial modem access, and persuade the victim to answer the VoLTE video call. The brief does not report active campaigns or public exploitation against real users.

The escalation vulnerability is not listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog. As a result, there is no recorded inclusion date or remediation deadline.

Within the past 90 days, the KEV catalog added CVE-2026-11645 on June 9, 2026, and CVE-2025-48595 on June 2, 2026, both associated with Google. These entries do not demonstrate that Unisoc modem vulnerabilities have been exploited and do not constitute Unisoc-specific KEV precedents.