Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access
Unisoc modem firmware flaw CWE-1189 allows VoLTE video call RCE chain to gain full Android kernel access on T606/T612/T7250 chipsets; no patch yet.
SSD Secure Disclosure published the second stage of an exploit chain, first disclosed in March 2026, that achieves full Android kernel access on Unisoc modem firmware via a VoLTE video call. The privilege-escalation flaw, classified as CWE-1189 (Improper Isolation of Shared Resources on System-on-a-Chip), exploits shared physical memory between modem and application processor with no hardware boundary, letting modem code map the entire 32-bit address space and modify Android kernel pages via ARM Memory Protection Unit registers. Confirmed affected chipsets include Unisoc T606 (Motorola E13), T612 (Realme C33), and T7250 (Xiaomi Redmi A5), sold across more than 140 countries. No CVE has been assigned, the August 2026 Android Security Bulletin does not address it, and Unisoc has not responded to researchers; exploitation requires an attacker-controlled private 4G network and a victim answering the call.
- Two-stage chain: March 2026 RCE plus August 2026 privilege escalation
- CWE-1189 flaw allows modem to write Android kernel memory via ARM MPU
- Affects Unisoc T606, T612, T7250 in Motorola, Realme, Xiaomi phones
- No CVE assigned, no patch from Unisoc, not covered in August 2026 bulletin
- Exploitation requires private 4G network and answering VoLTE video call
- Countries
- China
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-20210 | The UE and the EMM communicate with each other using NAS messages | 9.8 | 4% | ||
| CVE-2025-31718 | In modem, there is a possible system crash due to improper input validation | 7.5 | <1% |
From the original article
3 min read at thehackernews.com
Security researchers at SSD Secure Disclosure have published a two-stage exploit chain that achieves full Android kernel access on devices running Unisoc modem firmware through a VoLTE video call, with no fix from the chipset maker.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.