Unisoc VoLTE Video-Call Exploit Chain Escalates Modem RCE to Full Android Kernel Access
Unisoc VoLTE Video-Call Exploit Chain Escalates Modem RCE to (TL-2026-2049) is a high-severity software vulnerability, first published 2026-08-17. It has no confirmed attribution, affects Unisoc T606 baseband/SoC, maps to 9 MITRE ATT&CK techniques (T1014, T1190, T1203), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-2049
- Threat ID
- TL-2026-2049
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-08-17
- Last reviewed
- 2026-08-17
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- consumerelectronics, telecoms, mobiledevicemanufacturing
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Unisoc VoLTE Video-Call Exploit Chain Escalates Modem RCE to
Malware and tooling: Open5GS + Kamailio rogue IMS core
Independent researcher 0x50594d, working with SSD Secure Disclosure, chained two unpatched Unisoc baseband firmware flaws to escalate a March 2026 modem-level RCE (malformed VoLTE video-call SDP) into full Android kernel code execution by disabling ARM Memory Protection Unit isolation via modem coprocessor registers. No CVE or vendor patch exists for the privilege-escalation step, and Unisoc has not responded to disclosure outreach.
How Unisoc VoLTE Video-Call Exploit Chain Escalates Modem RCE to works
SSD Secure Disclosure published a two-stage exploit chain against Unisoc baseband firmware shared across the T606, T612, T616 and T7250 chipset family, used in budget Android phones from Motorola, Realme, and Xiaomi, with reporting also noting the chipset family's broader footprint in Honor, Samsung, and vivo devices across 140+ countries.
Stage 1 (disclosed 2026-03-11, "UNISOC T612 RCE") is a CWE-674 uncontrolled-recursion stack overflow in the modem's `_SDPDEC_AcapDecoder` SDP parser. An attacker who has registered as a UE on an IMS core network sends a SIP INVITE whose SDP body contains repeated `acap:1` attributes (`v=0` / `a=acap:1 acap:1 acap:1 [...]`); the decoder recurses without a depth limit, colliding the SIP task stack with the `sblock_0_2` task stack when the victim answers the resulting video call and SRTP packet fragmentation activates that task. This overwrites stack-resident function pointers, including the `SipHandler_AttrDecoder` handler-table entry at 0x8d0f25c0, and a PoC register write (`r1 = 0x8d0f270c`, value `0xdeadbeef`) confirms controlled corruption. ARM Thumb shellcode, split into 28-byte segments separated by 356-byte (`HOLE_BETWEEN_PARTS`) gaps to survive SIP message fragmentation, executes with modem-context privileges once the overwritten pointer is invoked.
Stage 2 (disclosed 2026-08-17, "UNISOC T612 LPE") is CWE-1189, improper isolation of shared resources on the SoC: because the modem and application processor share the same physical address space (0x00000000-0x100000000) with no hardware-enforced boundary, code already running in modem context can reconfigure ARM Memory Protection Unit region 0 via coprocessor 15 operations (`MOV r0,#0x0` / `MCR p15,0,r0,c6,c2,0` to clear the region's base, `DSB`, then `MOV r0,#0x10b` / `MCR p15,0,r0,c6,c1,4` to remap the full 32-bit address space read/write/execute, `ISB`/`DSB`). Delivery is via SIP REGISTER (rogue-IMS authentication), a REG-notification subscription, then an egg-hunter payload fragmented across five INVITE-delivered parts separated by 0x1bc-byte gaps and reassembled at 0x8de00000 using the 0xffeaef marker. A follow-up video call triggers egg-hunter execution, the MPU disable sequence, a kernel shellcode write into 0x804f6b58 inside `__arm64_compat_sys_vmsplice` (kernel base 0x80080000; a mutex/`__bss_stop` region at 0x821640e0 is also referenced by the PoC), and a branch trampoline installed at `do_sys_open` (0x804adb00) redirecting execution to the injected code -- achieving full Android kernel code execution confirmed via kernel log (`printk`) output.
Completing the full chain requires the attacker to control a private/rogue 4G IMS network (researchers used a Docker-based Open5GS core with a Kamailio SIP proxy, a Milenage-algorithm implementation for IMS/USIM authentication, a LimeSDR software-defined radio for over-the-air delivery, and Osmocom test USIMs) and the victim to answer an incoming video call -- no other user interaction is needed. Unisoc has not issued a security bulletin for the isolation flaw, the August 2026 Android Security Bulletin predates and does not cover it, and SSD states vendor outreach via email and LinkedIn went unanswered on both disclosures; Infosecurity Magazine reported its own outreach to Unisoc also went unanswered. Related prior research from Kaspersky ICS CERT (2025-11-20) found an architecturally identical modem/kernel memory-isolation gap, exploitable via the same shared-physical-address-space design pattern, on the related Unisoc UIS7862A SoC used in vehicle head units, underscoring that the flaw recurs across the Unisoc product line beyond phones.
MITRE ATT&CK techniques used in TL-2026-2049
Defense Evasion
Initial Access
T1190 Exploit Public-Facing Application; T1664 Exploitation for Initial Access
Execution
T1203 Exploitation for Client Execution; T1658 Exploitation for Client Execution
Resource Development
T1587.004 Develop Capabilities: Exploits; T1588.002 Obtain Capabilities: Tool
defense-impairment
T1601.001 Modify System Image: Patch System Image; T1685 Disable or Modify Tools
Affected products and versions in Unisoc VoLTE Video-Call Exploit Chain Escalates Modem RCE to
- Unisoc — T606 baseband/SoC
Vulnerable versions: all shipping firmware; no patch available - Unisoc — T612 baseband/SoC
Vulnerable versions: MOCORTM_22A_W23.02.5_P12.14_Debug and other shipping firmware; no patch available - Unisoc — T616 baseband/SoC
Vulnerable versions: listed as affected in the T612 RCE advisory's affected-products; no patch available - Unisoc — T7250 baseband/SoC
Vulnerable versions: all shipping firmware; no patch available - Motorola — Moto E13
Vulnerable versions: Android security patch level 2025-02-01, Unisoc T606 - Realme — C33
Vulnerable versions: Android security update 2025-07-01, Unisoc T612 (primary PoC target device) - Xiaomi — Redmi A5
Vulnerable versions: Android security patch level 2026-01-01, Unisoc T7250
Remediation for Unisoc VoLTE Video-Call Exploit Chain Escalates Modem RCE to
Immediate actions
- Restrict or disable VoLTE/video calling where organizationally feasible on devices built with affected Unisoc T606/T612/T616/T7250 basebands
- Instruct high-risk users not to accept video calls from unknown or unverified numbers on affected devices
- Monitor for anomalous SIP REGISTER/INVITE activity or rogue IMS registrations at the carrier/network level as a compensating control
Workarounds
- No workaround fully closes the flaw; disabling VoLTE/video-calling functionality where supported by the device reduces but does not eliminate the remote attack surface
Longer-term hardening
- Replace or retire devices built on unpatched Unisoc T606/T612/T616/T7250 basebands where the threat model requires kernel-integrity assurance
- Push OEMs (Motorola, Realme, Xiaomi, and other Unisoc licensees such as Honor, Samsung, vivo) and carriers to obtain a Unisoc firmware fix enforcing hardware-level modem/application-processor memory isolation
- Favor SoC designs with hardware-enforced (not software-reconfigurable) memory isolation between baseband and application processors in future procurement
Weaknesses (CWE) in Unisoc VoLTE Video-Call Exploit Chain Escalates Modem RCE to
CWE-1189, CWE-674
Timeline of Unisoc VoLTE Video-Call Exploit Chain Escalates Modem RCE to
- Motorola E13 (Unisoc T606) test device observed at the February 2025 Android security patch level; the modem/kernel isolation flaw is not addressed at this patch level.
- Realme C33 (Unisoc T612), the primary PoC target device, running the July 2025 Android security update, later used by 0x50594d to demonstrate the full exploit chain.
- Unisoc publishes an advisory for CVE-2025-31718 (CVSS 7.5), a separate modem input-validation privilege-escalation flaw in the same T6xx/T7xx chipset family, distinct from the unpatched MPU-isolation issue.
- Kaspersky ICS CERT publishes "God Mode On," documenting an architecturally identical lack of modem/application-processor memory isolation on the related Unisoc UIS7862A SoC used in vehicle head units, including a hardware-level DMA-based path assessed as unfixable via software update.
- Xiaomi Redmi A5 (Unisoc T7250) test device observed at the January 2026 Android security patch level; the isolation flaw remains present.
- SSD Secure Disclosure publishes "UNISOC T612 RCE": a CWE-674 uncontrolled-recursion stack overflow in the modem's _SDPDEC_AcapDecoder SDP parser, remotely triggerable via a malformed VoLTE video-call INVITE, granting modem-context code execution.
- The Hacker News and Infosecurity Magazine publish independent coverage of the combined two-stage exploit chain; SSD states vendor outreach to Unisoc via email and LinkedIn went unanswered on both disclosures, and Infosecurity Magazine reports its own outreach to Unisoc also went unanswered.
- The August 2026 Android Security Bulletin is published without addressing the privilege-escalation flaw; no Unisoc security bulletin covers it either.
- SSD Secure Disclosure publishes "UNISOC T612 LPE": the ARM MPU region-0 coprocessor-register bypass that escalates modem-context code execution to full Android kernel code execution.
Sources cited for Unisoc VoLTE Video-Call Exploit Chain Escalates Modem RCE to
- Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access
- UNISOC Modem Flaw Enables Remote Code Execution via Video Calls
- UNISOC T612 RCE - SSD Secure Disclosure
- UNISOC T612 LPE - SSD Secure Disclosure
- God Mode On: Researchers run Doom on a vehicle's head unit after remotely attacking its modem
- CVE-2025-31718 Detail (NVD)
- Unisoc Security Announcement (CVE-2025-31718)
Threats related to Unisoc VoLTE Video-Call Exploit Chain Escalates Modem RCE to
Detection coverage for TL-2026-2049
As of 2026-08-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2049 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.