UNISOC Modem Flaw Enables Remote Code Execution via Video Calls
A critical vulnerability in UNISOC modems allows remote code execution with kernel privileges, potentially exploitable through specially crafted video calls.
A significant security flaw has been identified in the firmware of UNISOC modems, which are widely used in Android smartphones globally. This vulnerability, classified as Improper Isolation of Shared Resources on System-on-a-Chip (SoC) and tracked under CWE-1189, allows for arbitrary code execution with kernel privileges. The exploit chain demonstrated by researchers at SSD Secure Disclosure shows how an attacker could escalate privileges from the modem context directly into the Android kernel.
The core of the issue lies in a lack of proper memory isolation between the modem's operational space and the Android kernel's memory. This deficiency enables code running on the modem to access and potentially manipulate memory regions used by the operating system's kernel. Researchers successfully demonstrated a full exploit chain, building upon previously disclosed UNISOC modem RCE vulnerabilities, to achieve this kernel-level compromise.
Specific affected devices include the Xiaomi Redmi A5 (with a January 1, 2026 security patch) and the Motorola E13 (with a February 1, 2025 security patch), according to SSD's research. The exploit chain was tested against a Realme C33 running a July 2025 Android security update. The researchers detailed how they could disable protections on a Memory Protection Unit (MPU) region, granting the modem context access to physical memory, including that of the Android kernel.
The final stage of the exploit involves initiating a video call to the target device. Using a Voice over Long-Term Evolution (VoLTE) connection, the researchers successfully triggered the execution of a payload in kernel space, demonstrating a practical and concerning attack vector. This method highlights how common communication protocols can be leveraged to exploit deep-seated hardware vulnerabilities.
As of the disclosure, there is no vendor-provided firmware update available to address this specific flaw. Affected device owners are reliant on future patches from UNISOC and handset manufacturers for remediation. The researchers noted that they attempted to contact UNISOC through multiple channels without receiving a response, and Infosecurity Magazine also reached out for comment without immediate success.
This vulnerability is not an isolated incident in the realm of modem security. Similar risks have been highlighted in other cellular modem components, such as Cinterion modem vulnerabilities disclosed in 2024, which also posed risks of arbitrary code execution and memory manipulation. The UNISOC flaw underscores the critical importance of robust security measures and memory isolation within the complex chipsets that power modern mobile devices.
UNISOC, a major global fabless semiconductor company headquartered in Shanghai, specializes in chipsets for 2G/3G/4G/5G mobile communication, IoT, and smart devices. The widespread use of their chipsets means that a successful exploitation of this vulnerability could impact millions of Android users worldwide, potentially leading to severe data breaches or device compromise.
The implications of this vulnerability are far-reaching, as kernel-level access allows an attacker to bypass many standard security controls within the Android operating system. This could enable a wide range of malicious activities, from persistent surveillance to the installation of further malware, making prompt patching a critical priority for affected users and manufacturers.