Full research report
Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access
Executive assessment
This disclosure documents a complete, unpatched exploit chain that links a remote code execution flaw in Unisoc modem SDP parsing to a privilege escalation that reaches the Android kernel, with no CVE identifier assigned to either stage and no patch committed by the vendor. The architectural root cause — a shared physical address space between the modem and application processor with no hardware-enforced boundary — has been independently confirmed by Kaspersky ICS CERT on a separate Unisoc chipset, indicating this is a systemic design characteristic affecting multiple product lines including vehicle head units. Kaspersky additionally identified a hidden DMA peripheral on the UIS7862A that provides a hardware-level lateral-movement path that cannot be addressed through firmware. The practical attack barrier is high — requiring custom 4G infrastructure and victim interaction — but the full chain has been demonstrated end-to-end on consumer devices running security patches current as of early 2026, and no remediation is available to affected device owners.
What happened
On 17 August 2026 SSD Secure Disclosure published the second stage of a two-part exploit chain against Unisoc modem firmware. The first stage, released in March 2026, achieves remote code execution on the modem via a malformed SDP payload within a SIP video call. The August 2026 second stage exploits the complete absence of a hardware-enforced memory boundary between the Unisoc modem processor and the Android application processor to escalate from modem-level to full Android kernel code execution. Unisoc has not responded to coordinated disclosure attempts across multiple channels and has issued no patch for either stage.
Affected scope
Devices running Unisoc T606 (Motorola E13, security patch February 2025), T612 (Realme C33), T616, and T7250 (Xiaomi Redmi A5, security patch January 2026) chipsets. Unisoc supplies chipsets to multiple brands sold across more than 140 countries, with concentrated deployment in emerging markets. Kaspersky ICS CERT separately confirmed the same architectural weakness on the Unisoc UIS7862A found in vehicle head units.
Technical assessment
The privilege-escalation step exploits the Unisoc SoC design in which the modem communication processor and the Android application processor share a single physical address space with no hardware-enforced boundary. After gaining modem-level code execution via the RCE first stage, the researcher writes a permissive configuration to the modem's ARM Memory Protection Unit through coprocessor registers, mapping the full 32-bit physical address space — including Android kernel pages at physical address 0x80080000 — as readable, writable, and executable from modem context. Kernel-level code execution was confirmed by observing injected payload output in kernel logs. Kaspersky's independent research on the UIS7862A additionally identified a hidden DMA peripheral that provides a hardware-level lateral-movement path not addressable through firmware update.
Recommended defensive actions
- Monitor device manufacturer firmware update channels for Unisoc modem patches and apply any releases immediately.
- Disable VoLTE on affected devices where operationally feasible to remove the primary attack-delivery path.
- Inventory deployed mobile and embedded devices by chipset to identify exposure across the Unisoc T606/T612/T616/T7250 family.
- Hunt for anomalous IMS or SIP signalling patterns — particularly unexpected SIP INVITE messages with malformed SDP — that may indicate attacker-controlled cellular infrastructure targeting users.
Uncertainties and evidence gaps
- Whether CVE-2025-31718 (October 2025 Unisoc advisory, CVSS 7.5, modem input-validation flaw) corresponds to the March 2026 SSD RCE first stage remains unconfirmed; the article states the relationship is unclear and the Unisoc advisory page was inaccessible for direct verification.
- The full list of affected Unisoc chipsets and consumer device models is not exhaustive; SSD tested three devices but noted the firmware weakness may extend to additional variants.
- Neither the March 2026 RCE nor the August 2026 LPE has been assigned a CVE identifier, complicating tracking and remediation prioritisation.
- Whether any threat actor has independently discovered and operationalised this chain outside researcher-controlled environments is unknown; no threat intelligence chatter was found.
- The supplied reporting identifies CVE-2022-20210, but the reviewed sources did not establish its distinct role in this event.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No confirmed active exploitation in the wild; SSD Secure Disclosure published a complete working proof-of-concept for the two-stage chain, requiring attacker-controlled 4G cellular infrastructure and a victim who answers an incoming VoLTE video call.
The investigation began with the THN article identifying a two-stage exploit chain, two stated CVEs, and URLs to the SSD Secure Disclosure advisories. Both SSD advisories were fetched directly and confirmed, establishing the technical mechanism, affected devices, and unpatched status. The Kaspersky ICS CERT November 2025 report was retrieved and independently confirmed the same shared-memory architectural weakness on a separate Unisoc chipset, corroborating the root cause as a systemic design issue. Check Point Research's 2022 advisory verified the historical context for CVE-2022-20210 as a distinct, patched vulnerability. CVE-2025-31718 was confirmed to exist via search results but its Unisoc advisory page was inaccessible, leaving its precise relationship to the March 2026 RCE unresolved.
- What does the primary source article state and what URLs does it surface?Fetched The Hacker News articlethehackernews.com ↗
Confirmed two-stage chain: March 2026 RCE via malformed SDP/SIP, August 2026 LPE via ARM MPU reconfiguration; affected chipsets T606/T612/T7250; SSD advisory URLs, Kaspersky URL, and CVE-2025-31718 identified.
why Established the event timeline and surfaced primary source URLs for independent verification.
- Does the SSD LPE advisory exist and what does it contain?Fetched the SSD Secure Disclosure LPE advisoryssd-disclosure.com ↗
Advisory confirmed: CWE-1189, no CVE assigned, unpatched; Motorola E13 and Xiaomi Redmi A5 tested; PoC uses Open5GS, Kamailio, and SDR hardware; researcher credited as 0x50594d.
why Primary source confirmed with authoritative technical detail and definitive patch status.
- Does the SSD RCE advisory for the first stage exist and what are its scope and mechanism?Fetched the SSD Secure Disclosure RCE advisoryssd-disclosure.com ↗
Published March 2026; CWE-674 uncontrolled recursion in _SDPDEC_AcapDecoder SDP parser; affects T612, T616, T606, T7250; no CVE assigned; vendor unresponsive; Realme C33 used as primary test device.
why Confirmed first-stage prerequisites, expanded affected chipset list, and established vendor non-response pattern from the earlier disclosure.
- Has independent research confirmed the shared modem/application-processor memory boundary weakness on Unisoc silicon?Fetched Kaspersky ICS CERT November 2025 reportics-cert.kaspersky.com ↗
Kaspersky confirmed the same shared physical address space weakness on the Unisoc UIS7862A (CVE-2024-39432, CVE-2024-39431); additionally identified a hidden DMA peripheral constituting a hardware-level issue not fixable through software update.
why Independent corroboration from a credible, separate research team confirms the architectural root cause is systemic rather than isolated to a single firmware release.
- What is the confirmed status and scope of CVE-2022-20210?Fetched Check Point Research 2022 UNISOC baseband disclosureresearch.checkpoint.com ↗
CVE-2022-20210, CVSS 9.4, NAS message parsing heap overflow in T700 and related chipsets; disclosed and patched May 2022 via Android Security Bulletin; distinct from current disclosures.
why Confirmed CVE-2022-20210 is a historical, patched vulnerability cited for contrast; it does not represent current unpatched exposure.
- Is there independent editorial corroboration of the August 2026 disclosure?Fetched Infosecurity Magazine article on the Unisoc modem RCEinfosecurity-magazine.com ↗
Independently confirmed vulnerability details, affected devices, and vendor non-response; Infosecurity Magazine also received no reply from Unisoc.
why Provides second-domain independent corroboration, satisfying the evidentiary requirement for medium/high confidence.
- Can CVE-2025-31718 be verified from official Unisoc or NVD records?Searched vulnerability databases and attempted to fetch the Unisoc advisory page
CVE-2025-31718 confirmed as a modem input-validation flaw (CWE-20, CVSS 7.5) on the same chipset family from an October 2025 Unisoc advisory; the Unisoc advisory URL returned a connection error and Vulners returned HTTP 403, preventing direct page verification. The relationship to the March 2026 SSD RCE remains unconfirmed.
why CVE existence is established via search corroboration but its precise link to the SSD chain cannot be confirmed from accessible primary sources; noted as a material uncertainty.
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 60 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| The Hacker Newsnews | ok9 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok8 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CISA KEVkev | ok1666 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5324 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok685 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1009 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| FIRST EPSSepss | ok | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok13 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1590 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | ok900 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 9 opened outside the registered collection
PoC & exploit code2
Full technical write-up and PoC for the privilege-escalation stage; published 17 August 2026; no CVE assigned.
Prerequisite RCE first stage via malformed SDP within a SIP video call; published March 2026; no CVE assigned.
Vendor & gov advisories2
Primary disclosure for the unpatched privilege-escalation; vendor unresponsive to multiple disclosure attempts.
First-stage RCE disclosure; vendor similarly unresponsive; no Android Security Bulletin entry.
Analysis & research3
Independent November 2025 research confirming the same shared modem/application-processor physical memory weakness on the Unisoc UIS7862A; identifies an additional hardware-level DMA issue not fixable by software update.
2022 disclosure of CVE-2022-20210 (CVSS 9.4); patched via Android Security Bulletin; cited in the story as historical contrast to current unpatched disclosures.
Independent editorial corroboration; Infosecurity Magazine separately confirmed vendor non-response.