Unisoc Modem VoLTE Exploit Chain
Security researchers have published a two-stage exploit chain that achieves full Android kernel access on devices running Unisoc modem firmware. The attack works through a VoLTE video call, and the chipset maker has not released a fix.
The advisory, published August 17, 2026, is the second stage of a chain that began in March 2026. That earlier disclosure detailed remote code execution in the same firmware through a malformed SIP video call. Completing the full chain requires the attacker to control a private 4G cellular network and the victim to answer the incoming video call.
SSD Secure Disclosure published the research. The company said: "We have tried to reach out to the vendor through multiple channels (email and LinkedIn) but have not been able to receive any response."
The research was carried out by an independent security researcher using the handle 0x50594d.
Let me walk you through the Unisoc modem VoLTE exploit chain, what it means for affected devices, and why there's currently no fix.
Exploit Chain Key Takeaways
- Two-stage exploit chain exploits Unisoc modem firmware
- Requires VoLTE video call in order for attack to be launched
- Android kernel access is fully obtained
- Unisoc does not have any patch against it
- Vulnerabilities affect Motorola E13, Realme C33, and Xiaomi Redmi A5 phones
- The attacker should have control over a 4G private network
What Is the Unisoc Modem VoLTE Exploit Chain?
The Unisoc modem VoLTE exploit chain is a two-stage attack. The first stage was disclosed in March 2026. It allowed remote code execution in the modem firmware through a malformed SIP video call.
The second stage, published August 17, 2026, is a privilege escalation. Once the attacker has code running on the modem, they can escalate to full Android kernel access.
Several prerequisites need to be met for the whole attack:
- The attacker should have the private 4G cellular network under his control
- The victim should accept the incoming video call
- The modem firmware should be vulnerable
Why This Matters:
If these conditions are met, an attacker can completely compromise the device. They can access everything on the phone. No user interaction is required beyond answering the call.
Which Devices Are Affected?
The Unisoc modem VoLTE exploit chain affects devices using at least three Unisoc chipsets:
- T606 – Found in the Motorola E13
- T612 – Found in the Realme C33
- T7250 – Found in the Xiaomi Redmi A5
Confirmation:
Researchers confirmed the privilege-escalation flaw on a Motorola E13 carrying a February 2025 security patch. They also confirmed it on a Xiaomi Redmi A5 carrying a January 2026 patch.
The Modem Firmware:
The flaw resides in the modem firmware shared by these chipsets. Unisoc is a Shanghai-based chipmaker formerly known as Spreadtrum. The company supplies components to brands including Motorola, Realme, and Xiaomi for devices sold across more than 140 countries.
How the Exploit Chain Works
The Unisoc modem VoLTE exploit chain requires a modem-level foothold first. This comes from the March 2026 RCE vulnerability.
Step 1: Modem Code Execution
The attacker sends a malformed SIP video call. The victim takes the call. Remote code execution is initiated in the modem.
Step 2: Privilege Escalation
Once code is running on the modem, the attacker writes a full-access configuration to the modem's ARM Memory Protection Unit. They do this through coprocessor registers.
The result? The entire 32-bit physical address space is mapped as readable, writable, and executable from the modem context. This is inclusive of the pages containing the Android Kernel.
Step 3: Kernel Access
The modem can now modify kernel memory. Researchers confirmed kernel-level code execution on a test device by observing kernel log output showing that the injected payload had run.
The Architectural Condition:
The key to the Unisoc modem VoLTE exploit chain is a shared physical memory space between the modem processor and the application processor. There's no hardware-enforced boundary preventing modem-context code from modifying kernel memory.
This is a fundamental design issue. The modem and the Android kernel share the same physical memory address space. Once an attacker controls the modem, they can access everything.
The Research Environment
The researchers built their proof-of-concept environment using:
- An open-source 4G core network
- A software-defined radio for the 4G radio interface
- Specialized SIM cards
This is not a simple attack. It requires significant resources. But it demonstrates a fundamental security flaw.
No Patch Available
The Unisoc modem VoLTE exploit chain currently has no fix.
The Android Security Bulletin:
The August 2026 Android Security Bulletin, published before this disclosure, does not address the privilege-escalation vulnerability. No UNISOC security bulletin covers it.
Previous Patches:
A coordinated Unisoc modem vulnerability uncovered by Check Point Research in 2022 (CVE-2022-20210) was patched by UNISOC and distributed through the Android Security Bulletin. The two currently disclosed vulnerabilities carry no such assurance.
What Users Can Do:
Device owners currently have no available patch or mitigation. They should watch for a firmware update from their device manufacturer. But no such update has been committed to by UNISOC.
The Kaspersky Connection
The Unisoc modem VoLTE exploit chain follows independent research published in November 2025 by Kaspersky ICS CERT.
The Kaspersky Research:
Kaspersky documented the same architectural condition on a different Unisoc chip, the UIS7862A, found in vehicle head units. After gaining modem code execution via a separate vulnerability, the Kaspersky team was also able to reach and modify the running Android kernel by exploiting the shared physical address space.
The Hardware Issue:
Kaspersky described one of its lateral movement paths as a hardware-level issue not fixable through a software update. This involved a hidden Direct Memory Access peripheral.
The Difference:
The Memory Protection Unit route used in the SSD chain is in principle addressable through a firmware change. But no such update has been committed to by UNISOC.
The Bigger Picture
The Unisoc modem VoLTE exploit chain highlights a fundamental security issue in how modems and application processors communicate.
The Problem:
Many System-on-Chip designs share physical memory between the modem and the application processor. This is done for performance reasons. However, it forms a security boundary that's hard to enforce.
The Risk:
If an attacker gains access to the modem, then the attacker can use the modem as a backdoor to access the memory of the application processor including the kernel. The modem is effectively a backdoor into the entire device.
The Industry Response:
Chip makers have to resolve this architecture problem. Memory protection at the hardware level is necessary. It might not be enough on its own.
What It Means For You
The Unisoc modem VoLTE exploit chain pose a serious danger to users:
The Danger:
- They have full access to the kernel
- They can steal your data and monitor activity
- They can install persistent malware
- There is no patch yet
Watch Out for:
- Firmware updates
- Being very careful with accepting video calls from numbers that you don’t recognize
- Using another device when in risky areas
Conclusion
Unisoc modem VoLTE exploit chain is a serious vulnerability which poses a threat to many devices. It allows attackers to gain full Android kernel access through a video call.
Key points to remember:
- Two-stage exploit chain targets Unisoc modem firmware
- Requires a VoLTE video call to trigger
- No patch is available from Unisoc
- Affects Motorola E13, Realme C33, and Xiaomi Redmi A5
- Attacker must control a private 4G network
- Shared physical memory space is the root cause
Device owners should watch for firmware updates. Be cautious about answering video calls. Use another device when you are working in a high risk environment.
The Unisoc modem VoLTE exploit chain is a reminder that fundamental design choices can create security vulnerabilities. Hardware-level fixes are needed.
FAQ Section
What is the Unisoc modem VoLTE exploit chain?
It's a two-stage exploit that gives attackers full Android kernel access through a VoLTE video call. The first stage is remote code execution on the modem. The second stage is privilege escalation to the kernel.
Which devices are affected?
The following devices, which use Unisoc chipsets such as T606 (Motorola E13), T612 (Realme C33), and T7250 (Xiaomi Redmi A5). Other Unisoc devices may also be vulnerable.
Is there a patch available?
No. This flaw has not been patched by UNISOC yet. It is not mentioned in the Android Security Bulletin for August 2026.
How is the attack performed?
The attack requires that the attacker controls a private 4G network and triggers a video call request. Once the victim answers, the attacker gains modem code execution, then escalates to kernel access.
What should users do?
There is currently no available patch. Be wary of answering calls made by numbers that you do not know and keep an eye out for firmware updates provided by your device’s manufacturer.
