Full Report
Security researchers at SSD Secure Disclosure have published a two-stage exploit chain that achieves full Android kernel access on devices running Unisoc modem firmware through a VoLTE video call, with no fix from the chipset maker. The advisory, published August 17, 2026, is the second stage of a chain that began in March 2026, when SSD disclosed remote code execution in the
Analysis Summary
# Vulnerability: Unisoc SoC Local Privilege Escalation via Modem Firmware
## CVE Details
- **CVE ID**: None Assigned (As of August 17, 2026)
- **CVSS Score**: Not officially rated (Estimated High/Critical based on kernel access)
- **CWE**: CWE-1189 (Improper Isolation of Shared Resources on System-on-a-Chip)
## Affected Systems
- **Products**: Devices utilizing Unisoc (formerly Spreadtrum) chipsets.
- **Versions**:
- Chipsets: T606, T612, T7250, and UIS7862A.
- Confirmed vulnerable devices: Motorola E13 (February 2025 patch), Xiaomi Redmi A5 (January 2026 patch), and Realme C33.
- **Configurations**: Devices running Unisoc modem firmware with shared physical memory architecture between the modem and the application processor.
## Vulnerability Description
The vulnerability stems from an architectural flaw where the modem processor and the application processor (AP) share a physical memory space without hardware-enforced boundaries.
An attacker who has already gained code execution on the modem (via a separate RCE vulnerability) can exploit this by writing a full-access configuration to the modem’s ARM Memory Protection Unit (MPU) through coprocessor registers. This allows the attacker to map the entire 32-bit physical address space—including the pages dedicated to the Android kernel—as readable, writable, and executable from the modem's context.
## Exploitation
- **Status**: PoC available (Demonstrated by SSD Secure Disclosure researchers).
- **Complexity**: High (Requires a multi-stage chain, including a prior modem RCE and control over cellular infrastructure).
- **Attack Vector**: Adjacent (Requires an attacker-controlled 4G cellular network and a victim to answer a VoLTE video call).
## Impact
- **Confidentiality**: High (Full access to kernel memory and system data).
- **Integrity**: High (Ability to modify the running Android kernel).
- **Availability**: High (Potential for total system compromise or persistent denial of service).
## Remediation
### Patches
- **No official fix available**: As of the report date, Unisoc has not released a firmware update to address the MPU configuration issue or the underlying shared memory isolation flaw.
### Workarounds
- **No direct workarounds**: Users are advised to exercise caution when receiving video calls from unknown sources, though this does not mitigate the underlying architectural vulnerability.
- **Manufacturer Updates**: Device owners should monitor for proprietary firmware updates from Motorola, Realme, and Xiaomi.
## Detection
- **Indicators of Compromise**:
- Unexpected kernel log output (if monitoring tools are present).
- Unexplained system instability following a VoLTE video call from an unknown or suspicious network.
- **Detection Methods**: Monitoring for unauthorized modifications to kernel memory or unusual modem-to-AP communication patterns.
## References
- SSD Advisory (LPE): hxxps[://]ssd-disclosure[.]com/unisoc-t612-lpe/
- SSD Advisory (RCE): hxxps[://]ssd-disclosure[.]com/unisoc-t612-rce/
- Kaspersky Research: hxxps[://]ics-cert[.]kaspersky[.]com/publications/reports/2025/11/20/god-mode-on-researchers-run-doom-on-a-vehicles-head-unit-after-remotely-attacking-its-modem/
- Original News Report: hxxps[://]thehackernews[.]com/2026/08/unisoc-volte-video-call-exploit-chain[.]html