Unisoc T612/T606/T7250 Modem Exploit Chain: Malicious VoLTE Video Call Enables Full Android Kernel Access (CVE-2025-31718 + Unpatched MPU Privilege Escalation) — Threadlinqs Intelligence
As of 2026-08-29, Unisoc T612/T606/T7250 Modem Exploit Chain: Malicious VoLTE Video Call Enables Full Android Kernel Access (CVE-2025-31718 + Unpatched MPU Privilege Escalation) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-2223 · Severity: HIGH · CVSS: 7.5 · Status: ACTIVE · Category: VULNERABILITY
Independent researcher 0x50594d, via SSD Secure Disclosure, chained an SDP/SIP parsing RCE in UNISOC modem firmware (CVE-2025-31718, CVSS 7.5) with a second, unpatched and CVE-less
The exploit chain targets budget Android devices built on UNISOC's T606, T612, T616 and T7250 modem chipsets and unfolds in two stages, disclosed roughly five months apart by SSD Secure Disclosure. To build and validate the chain, the researcher stood up an attacker-controlled cellular test network in the lab: an Open5GS open-source 4G/EPC core paired with a Kamailio SIP server for signaling, a LimeSDR software-defined radio as the 4G air interface, and specialized SIM cards. Network authentication to this rogue IMS/VoLTE network was scripted with a custom Python exploitation tool implementing the 3GPP Milenage algorithm and AKAv1-MD5 authentication vectors, so the only real-world prerequisite is that the attacker be a registered IMS/VoLTE subscriber able to place a video call to the victim over 4G.
Stage 1 (published 2026-03-11 as the 'UNISOC T612 RCE' advisory, tracked as CVE-2025-31718, CVSS 3.1 base score 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is a remote code execution bug in the modem's SIP/SDP signaling parser. The vulnerable function, _SDPDEC_AcapDecoder, looks up each SDP attribute name in the SipHandler_AttrDecoder dispatch table and invokes the matching handler; because 'acap' is itself an entry in that table, an SDP line containing repeated 'acap' attributes recurses into itself with no depth limit (CWE-674, Uncontrolled Recursion), consuming the stack. An attacker who is authenticated to an IMS/VoLTE network sends a crafted SIP INVITE containing this malformed SDP body (PoC: a line of the form 'a=acap:1 acap:1 acap:1 ...' repeated); when the victim initiates or answers a video call, SRTP packet fragmentation drives execution such that the SIP task's stack collides with an adjacent modem task's stack during the overflow, corrupting adjacent function pointers and yielding arbitrary native code execution inside the modem processor (ARM Cortex-R7 core; both stages' shellcode is compiled with -mcpu=cortex-r7 and largely written in ARM Thumb-mode). Researchers demonstrated a controlled write primitive via the SDP 'crypto' attribute, confirming stack control by writing the marker value 0xdeadbeef to address 0x8d0f270c and observing r1/r2 holding that address/value pair in a modem register/memory dump. Notably, NVD's own summary of CVE-2025-31718 states the flaw could lead to "remote escalation of privilege with no additional execution privileges needed" even though UNISOC's submitted CVSS vector scores it as availability-only (C:N/I:N/A:H, i.e. a crash/DoS) -- a real-world severity understatement, since SSD's research demonstrates the same root cause achieves full arbitrary code execution rather than a mere crash. This stage alone was independently disclosed by UNISOC in an October 2025 security bulletin (CWE-20, Improper Input Validation) -- which also covers a related but distinct denial-of-service sibling flaw, CVE-2025-31717 -- affecting a wider chipset family (T606, T612, T616, T750, T760, T765, T770, T820, S8000, T8300, T9300) running Android 13 through 16; UNISOC provided no patch guidance beyond directing OEMs to its support portal.
Stage 2 (published 2026-08-17 as the 'UNISOC T612 LPE' advisory, no CVE assigned) escalates from modem-context code execution to full Android kernel access. The modem shellcode delivered in Stage 1 uses an 'egg hunter' routine -- scanning forward from a base address of 0x8cbf469c for a marker value, then backtracking to the start of each chunk -- to locate payload fragments (0x4b0-byte chunks separated by 0x1bc-byte gaps) scattered across the modem heap during delivery and reassembles them at address 0x8de00000. It then executes an ARM coprocessor instruction sequence that fully disables the hardware isolation boundary between modem and application-processor memory: `MOV r0,#0x0` / `MCR p15,0,r0,c6,c2,0` / `DSB` to disable MPU region 0, followed by `MOV r0,#0x10b` / `MCR p15,0,r0,c6,c1,4` / `ISB` / `DSB` to reconfigure that region as full read-write-execute, mapping the
Weaknesses (CWE)
CWE-674, CWE-1189, CWE-20
Target sectors: consumer, telecoms
Target regions: Global
Timeline
- Check Point Research discloses CVE-2022-20210 (CVSS 9.4), an unrelated but architecturally similar UNISOC baseband NAS-message-parsing flaw enabling remote crash/code execution across smartphones and smart TVs; UNISOC patches it within about a month, in contrast to its non-response to the current chain.
- Motorola Moto E13 (UNISOC T606) tested at the February 2025 Android security patch level and confirmed vulnerable to the full two-stage exploit chain.
- Realme C33 (UNISOC T612), running the July 2025 Android security update with modem firmware build MOCORTM_22A_W23.02.5_P12.14_Debug, used as the primary Stage 1 SDP/SIP RCE test target.
- UNISOC publishes its own security bulletin for CVE-2025-31718 and CVE-2025-31717, both improper-input-validation flaws in modem firmware across T606/T612/T616/T750/T760/T765/T770/T820/S8000/T8300/T9300, rated CVSS 7.5, with no concrete patch guidance beyond directing OEMs to its support portal.
- Kaspersky ICS CERT publishes 'God Mode On', documenting an analogous modem-to-kernel escape (CVE-2024-39432, 3G RLC stack-based buffer overflow) on UNISOC's UIS7862A chipset used in vehicle head units, reaching the same conclusion that modem and application-processor memory share an unprotected physical address space.
- Xiaomi Redmi A5 (UNISOC T7250) tested at the January 2026 Android security patch level and confirmed vulnerable to the full two-stage exploit chain.
- SSD Secure Disclosure publishes the 'UNISOC T612 RCE' advisory detailing the Stage 1 remote code execution in the modem's SDP/SIP parsing (_SDPDEC_AcapDecoder uncontrolled recursion, CWE-674, CVE-2025-31718), credited to researcher 0x50594d.
- SSD Secure Disclosure publishes the 'UNISOC T612 LPE' advisory disclosing the unpatched, CVE-less Stage 2 privilege escalation (ARM MPU region-0 disable, CWE-1189) that completes the modem-to-kernel exploit chain; The Hacker News and Dark Reading cover the full chain the same week.
- Infosecurity Magazine and Dark Reading publish secondary analysis of the exploit chain, reiterating that no patch or vendor response exists.
- Zimperium Mobile Threat Watch publishes its write-up of the exploit chain, reiterating that UNISOC has not responded to multiple disclosure contact attempts (email and LinkedIn) and that no patch or mitigation has been issued for the Stage 2 MPU flaw.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2025-31718, T1588.006, T1587.004, T1588.002, T1664, T1203, T1211, T1620, T1574, T1601.001, T1499.004
