Unisoc T612/T606/T7250 Modem Exploit Chain: Malicious VoLTE Video Call Enables Full Android Kernel Access (CVE-2025-31718 + Unpatched MPU Privilege Escalation)

Key facts for Unisoc VoLTE kernel escape

Detection coverage for Unisoc VoLTE kernel escape

As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2223 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: VoLTE SIP INVITE with Recursive SDP acap Attribute Chain (CVE-2025-31718 Stage 1 Trigger)

Detects a SIP INVITE carrying an SDP body with repeated 'a=acap:' attribute lines that drive the UNISOC modem's _SDPDEC_AcapDecoder dispatch table into uncontrolled recursion (CWE-674), the stack-overflow trigger for CVE-2025-31718. This is the network-signaling precondition for the full VoLTE-video-call modem-to-kernel exploit chain against UNISOC T606/T612/T616/T7250 devices, deliverable from any IMS/VoLTE-authenticated calling party.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1664, T1203, T1587.004
• Data sources: kamailio_sip_proxy_logs, ims_sbc_signaling_logs, carrier_cdr
• Severity: high
• Confidence: high

Splunk SPL

index=telecom_ims sourcetype="kamailio:sip" method=INVITE
| rex field=_raw "(?<sdp_body>(?s)v=0.*)"
| eval acap_count=if(isnotnull(sdp_body), mvcount(split(sdp_body, "a=acap:"))-1, 0)
| where acap_count>=5
| eval src_ims_uri=coalesce(from_uri, src_uri), dst_ims_uri=coalesce(to_uri, dst_uri)
| table _time, call_id, src_ims_uri, dst_ims_uri, acap_count, sdp_body
| sort -acap_count

Microsoft KQL

let AcapThreshold = 5;
IMSSignalingLogs_CL
| where TimeGenerated > ago(24h)
| where SipMethod_s == "INVITE"
| extend AcapCount = array_length(extract_all(@"a=acap:", SdpBody_s))
| where AcapCount >= AcapThreshold
| project TimeGenerated, CallId_s, SrcImsUri_s, DstImsUri_s, AcapCount, SdpBody_s
| sort by AcapCount desc

Sigma

title: VoLTE SIP INVITE with Recursive SDP acap Attribute (CVE-2025-31718 Trigger)
id: 7f3a1c2e-4b6d-4e8a-9c1f-a10203040501
status: experimental
description: Detects a SIP INVITE whose SDP body contains repeated 'a=acap:' attributes, the CWE-674 uncontrolled-recursion trigger for the UNISOC modem SDP/SIP parser RCE (CVE-2025-31718) used as Stage 1 of the VoLTE video-call modem-to-kernel exploit chain.
references:
    - https://ssd-disclosure.com/unisoc-t612-rce/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-31718
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-29
tags:
    - attack.resource-development
    - attack.t1587.004
    - attack.initial-access
    - attack.t1664
    - attack.execution
    - attack.t1203
    - cve.2025.31718
    - cwe.674
logsource:
    category: application
    product: kamailio
    service: sip
detection:
    selection_invite:
        sip_method: 'INVITE'
    selection_sdp:
        sdp_body|contains|all:
            - 'a=acap:'
    condition: selection_invite and selection_sdp | count(sdp_body|re|'a=acap:') by call_id >= 5
falsepositives:
    - Legitimate SDP capability negotiation (RFC 4566 'acap' attribute) used by some enterprise SBCs/PBXs for authenticated access to a small number of session-level capabilities
    - SBC interoperability/compliance test suites that replay large synthetic SDP bodies
level: high

Known false positives:

• Legitimate SDP capability negotiation (RFC 4566 'acap' attribute) used by some enterprise SBCs/PBXs for authenticated access to a small number of session-level capabilities
• SBC interoperability/compliance test suites that replay large synthetic SDP bodies

Tuning notes: Baseline the acap_count threshold (default 5) per SBC/carrier vendor to separate legitimate SDP capability negotiation from the dozens-of-repeats pattern seen in the SSD PoC; allowlist known enterprise PBX from_uri domains that legitimately negotiate multiple acap capabilities.

• 🔒 IMS Signaling: Recursive SDP acap Attribute in VoLTE INVITE (CVE-2025-31718) · unlock with TL Creds
• 🔒 Mobile Kernel Telemetry: MPU Isolation Disable and Syscall Trampoline Patch · unlock with TL Creds
• 🔒 Sentinel: Fleet-Wide VoLTE Fan-Out and Modem-Crash Correlation (Chain Propagation/Retry) · unlock with TL Creds
• 🔒 Sigma: Recursive SDP acap Attribute in SIP INVITE (CVE-2025-31718) · unlock with TL Creds
• 🔒 Sigma: ARM MPU Region-0 Disable / Kernel Syscall Trampoline Patch (UNISOC Stage 2 LPE) · unlock with TL Creds
• 🔒 Sigma: Fleet-Wide VoLTE Fan-Out / Modem-Crash Cluster (Chain Propagation or Repeated Failed Attempts) · unlock with TL Creds
• 🔒 Kernel MPU Region-0 Disable and do_sys_open/vmsplice Trampoline Patch (Stage 2 LPE, CWE-1189) · unlock with TL Creds
• 🔒 Fleet-Wide VoLTE Exploitation Fan-Out and Repeated Modem-Crash Correlation (Egg-Hunter Payload Reassembly / Anti-Recrash Guard) · unlock with TL Creds

Indicators of compromise for Unisoc VoLTE kernel escape

As of 2026-08-29, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-2223.

How Unisoc VoLTE kernel escape works

A single answered VoLTE video call over attacker-controlled 4G/IMS infrastructure is enough to trigger the full chain; UNISOC has not responded to disclosure and no patch exists.

The exploit chain targets budget Android devices built on UNISOC's T606, T612, T616 and T7250 modem chipsets and unfolds in two stages, disclosed roughly five months apart by SSD Secure Disclosure. To build and validate the chain, the researcher stood up an attacker-controlled cellular test network in the lab: an Open5GS open-source 4G/EPC core paired with a Kamailio SIP server for signaling, a LimeSDR software-defined radio as the 4G air interface, and specialized SIM cards. Network authentication to this rogue IMS/VoLTE network was scripted with a custom Python exploitation tool implementing the 3GPP Milenage algorithm and AKAv1-MD5 authentication vectors, so the only real-world prerequisite is that the attacker be a registered IMS/VoLTE subscriber able to place a video call to the victim over 4G.

Stage 1 (published 2026-03-11 as the 'UNISOC T612 RCE' advisory, tracked as CVE-2025-31718, CVSS 3.1 base score 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is a remote code execution bug in the modem's SIP/SDP signaling parser. The vulnerable function, _SDPDEC_AcapDecoder, looks up each SDP attribute name in the SipHandler_AttrDecoder dispatch table and invokes the matching handler; because 'acap' is itself an entry in that table, an SDP line containing repeated 'acap' attributes recurses into itself with no depth limit (CWE-674, Uncontrolled Recursion), consuming the stack. An attacker who is authenticated to an IMS/VoLTE network sends a crafted SIP INVITE containing this malformed SDP body (PoC: a line of the form 'a=acap:1 acap:1 acap:1 ...' repeated); when the victim initiates or answers a video call, SRTP packet fragmentation drives execution such that the SIP task's stack collides with an adjacent modem task's stack during the overflow, corrupting adjacent function pointers and yielding arbitrary native code execution inside the modem processor (ARM Cortex-R7 core; both stages' shellcode is compiled with -mcpu=cortex-r7 and largely written in ARM Thumb-mode). Researchers demonstrated a controlled write primitive via the SDP 'crypto' attribute, confirming stack control by writing the marker value 0xdeadbeef to address 0x8d0f270c and observing r1/r2 holding that address/value pair in a modem register/memory dump. Notably, NVD's own summary of CVE-2025-31718 states the flaw could lead to "remote escalation of privilege with no additional execution privileges needed" even though UNISOC's submitted CVSS vector scores it as availability-only (C:N/I:N/A:H, i.e. a crash/DoS) -- a real-world severity understatement, since SSD's research demonstrates the same root cause achieves full arbitrary code execution rather than a mere crash. This stage alone was independently disclosed by UNISOC in an October 2025 security bulletin (CWE-20, Improper Input Validation) -- which also covers a related but distinct denial-of-service sibling flaw, CVE-2025-31717 -- affecting a wider chipset family (T606, T612, T616, T750, T760, T765, T770, T820, S8000, T8300, T9300) running Android 13 through 16; UNISOC provided no patch guidance beyond directing OEMs to its support portal.

Stage 2 (published 2026-08-17 as the 'UNISOC T612 LPE' advisory, no CVE assigned) escalates from modem-context code execution to full Android kernel access. The modem shellcode delivered in Stage 1 uses an 'egg hunter' routine -- scanning forward from a base address of 0x8cbf469c for a marker value, then backtracking to the start of each chunk -- to locate payload fragments (0x4b0-byte chunks separated by 0x1bc-byte gaps) scattered across the modem heap during delivery and reassembles them at address 0x8de00000. It then executes an ARM coprocessor instruction sequence that fully disables the hardware isolation boundary between modem and application-processor memory: `MOV r0,#0x0` / `MCR p15,0,r0,c6,c2,0` / `DSB` to disable MPU region 0, followed by `MOV r0,#0x10b` / `MCR p15,0,r0,c6,c1,4` / `ISB` / `DSB` to reconfigure that region as full read-write-execute, mapping the entire 32-bit physical address space (base 0x00000000, span 0x100000000) as RWX from modem context -- including the kernel's base at the modem-mapped physical address 0x80080000. The exploit then copies kernel shellcode into the kernel's __arm64_compat_sys_vmsplice function (kernel virtual address 0xffffffc0104f6b58, reachable from modem context at its RWX-mapped physical equivalent 0x804f6b58) and patches the do_sys_open syscall (kernel virtual address 0xffffffc0104adb00, modem-mapped equivalent 0x804adb00) with a trampoline branch instruction that redirects execution into the planted shellcode. A mutex placed at the kernel's __bss_stop symbol (kernel virtual address 0xffffffc0121640e0, modem-mapped equivalent 0x821640e0) is checked with a simple `if (*mutex == 1) { return; }` guard to block the payload from re-triggering on subsequent calls to the same syscall and crashing the device. Researchers confirmed full kernel-level code execution by redirecting do_sys_open into a call to the kernel's own printk function (kernel virtual address 0xffffffc0102ee85c) with the string "Exploit worked !", observed in the device's dmesg/kernel log. Root cause is classified CWE-1189, Improper Isolation of Shared Resources on a System-on-a-Chip -- an architectural defect, not a single fixable code bug, since the modem and application processor share physical memory with no hardware-enforced boundary.

SSD Secure Disclosure confirmed the full two-stage chain works against a Motorola Moto E13 (T606) on the February 2025 Android security patch level, a Realme C33 (T612, modem firmware build MOCORTM_22A_W23.02.5_P12.14_Debug) on the July 2025 Android security update, and a Xiaomi Redmi A5 (T7250) on the January 2026 security patch level -- the researcher explicitly cautions this is not an exhaustive device list. UNISOC has not responded to multiple disclosure attempts via email and LinkedIn, has not issued a patch or workaround, and neither its own advisories nor the August 2026 Android Security Bulletin address the Stage 2 flaw. There is no evidence of in-the-wild exploitation, and CVE-2025-31718 does not appear in CISA's Known Exploited Vulnerabilities catalog as of 2026-08-29; the chain is currently PoC-only.

This is not an isolated architectural lapse for UNISOC. In May 2022, Check Point Research disclosed CVE-2022-20210 (CVSS 9.4), a NAS-message-parsing flaw in UNISOC's baseband stack allowing remote crash and potential code execution across smartphones and smart TVs; UNISOC patched it within about a month of disclosure -- a markedly faster response than the current chain has received. More significantly, in November 2025 Kaspersky ICS CERT published 'God Mode On,' documenting an analogous modem-to-kernel escape (stack-based buffer overflow in the 3G RLC protocol stack, CVE-2024-39432) on UNISOC's UIS7862A chipset used in automotive head units, again pivoting from modem code execution to full application-processor control via the same class of shared, unprotected physical memory between modem and host -- including a hidden DMA peripheral offering an additional lateral-movement path that Kaspersky assessed as unfixable in software. Read together, these three UNISOC disclosures (2022, 2025, 2026) show a recurring, cross-product architectural weakness in how UNISOC isolates (or fails to isolate) modem firmware from the host processor, spanning smartphones, smart TVs, and now vehicle infotainment systems.

MITRE ATT&CK techniques by tactic:

Execution

T1203 Exploitation for Client Execution

Stealth

T1211 Exploitation for Stealth; T1574 Hijack Execution Flow; T1620 Reflective Code Loading

Impact

T1499.004 Application or System Exploitation

Resource Development

T1587.004 Exploits; T1588.002 Tool; T1588.006 Vulnerabilities

defense-impairment

T1601.001 Patch System Image

Initial Access

T1664 Exploitation for Initial Access

Remediation for Unisoc VoLTE kernel escape

Patches

• None available for the Stage 2 LPE/MPU flaw as of 2026-08-29; UNISOC has not responded to disclosure
• UNISOC's October 2025 bulletin for CVE-2025-31718/CVE-2025-31717 provided no concrete patch, only a pointer to OEM support

Immediate actions

• No vendor patch exists for the Stage 2 MPU/privilege-escalation flaw; monitor Motorola, Realme, Xiaomi and other UNISOC T606/T612/T616/T7250-based OEMs for a firmware update
• Where device settings allow, restrict or disable VoLTE video calling, since the confirmed attack path requires the victim to answer an incoming video call over VoLTE

Workarounds

• None confirmed by the researchers; UNISOC has not published an official mitigation for either stage

Longer-term hardening

• Track SSD Secure Disclosure and UNISOC's advisory channel (unisupport.unisoc.com) for a fix to the unassigned CWE-1189 MPU isolation flaw
• Enterprises or MDM fleets containing budget Android devices on UNISOC T606/T612/T616/T7250 modems should inventory affected models pending a patch
• Given UNISOC's repeated modem-to-kernel isolation failures (CVE-2022-20210, CVE-2024-39432, and this chain), treat any UNISOC-basebanded device -- including non-phone form factors such as vehicle infotainment head units -- as a standing risk class rather than a single-CVE issue

Affected and fixed versions

• UNISOC — T606 / T612 / T616 / T7250 modem firmware (SDP/SIP parser and MPU configuration logic)
  Vulnerable versions: All tested firmware builds as of 2026-08-17, including MOCORTM_22A_W23.02.5_P12.14_Debug (Realme C33 / T612)
• Motorola — Moto E13
  Vulnerable versions: February 2025 Android security patch level
• Realme — Realme C33
  Vulnerable versions: July 2025 Android security update
• Xiaomi — Redmi A5
  Vulnerable versions: January 2026 Android security patch level

Timeline of Unisoc VoLTE kernel escape

• 2022-06-02 Check Point Research discloses CVE-2022-20210 (CVSS 9.4), an unrelated but architecturally similar locked-ioc-18 baseband NAS-message-parsing flaw enabling remote crash/code execution across smartphones and smart TVs; locked-ioc-18 patches it within about a month, in contrast to its non-response to the current chain.
• 2025-02-01 locked-ioc-14 Moto E13 (locked-ioc-7) tested at the February 2025 Android security patch level and confirmed vulnerable to the full two-stage exploit chain.
• 2025-07-01 locked-ioc-19 C33 (locked-ioc-6), running the July 2025 Android security update with modem firmware build locked-ioc-1, used as the primary Stage 1 SDP/SIP RCE test target.
• 2025-10-11 locked-ioc-18 publishes its own security bulletin for CVE-2025-31718 and CVE-2025-31717, both improper-input-validation flaws in modem firmware across T606/T612/T616/T750/T760/T765/T770/T820/S8000/T8300/T9300, rated CVSS 7.5, with no concrete patch guidance beyond directing OEMs to its support portal.
• 2025-11-20 Kaspersky ICS CERT publishes 'God Mode On', documenting an analogous modem-to-kernel escape (CVE-2024-39432, 3G RLC stack-based buffer overflow) on locked-ioc-18's UIS7862A chipset used in vehicle head units, reaching the same conclusion that modem and application-processor memory share an unprotected physical address space.
• 2026-01-01 locked-ioc-20 Redmi A5 (locked-ioc-5) tested at the January 2026 Android security patch level and confirmed vulnerable to the full two-stage exploit chain.
• 2026-03-11 locked-ioc-4 publishes the 'locked-ioc-6 RCE' advisory detailing the Stage 1 remote code execution in the modem's SDP/SIP parsing (_SDPDEC_AcapDecoder uncontrolled recursion, CWE-674, CVE-2025-31718), credited to researcher locked-ioc-13.
• 2026-08-17 locked-ioc-4 publishes the 'locked-ioc-6 LPE' advisory disclosing the unpatched, CVE-less Stage 2 privilege escalation (ARM MPU region-0 disable, CWE-1189) that completes the modem-to-kernel exploit chain; The Hacker News and Dark Reading cover the full chain the same week.
• 2026-08-18 Infosecurity Magazine and Dark Reading publish secondary analysis of the exploit chain, reiterating that no patch or vendor response exists.
• 2026-08-28 Zimperium Mobile Threat Watch publishes its write-up of the exploit chain, reiterating that locked-ioc-18 has not responded to multiple disclosure contact attempts (email and LinkedIn) and that no patch or mitigation has been issued for the Stage 2 MPU flaw.

Sources cited for Unisoc VoLTE kernel escape

• UNISOC T612 RCE (Stage 1 advisory) ssd-disclosure.com · Advisory · 2026-03-11
• UNISOC T612 LPE (Stage 2 advisory) ssd-disclosure.com · Advisory · 2026-08-17
• NVD - CVE-2025-31718 Detail NVD (NIST) · Advisory · 2025-10-11
• UNISOC Security Announcement (CVE-2025-31718, CVE-2025-31717) unisoc.com · Vendor report · 2025-10-11
• Check Point Research: Vulnerability within the UNISOC baseband opens mobile phones communications to remote hacker attacks (CVE-2022-20210) Check Point Research · Research · 2022-06-02
• Kaspersky ICS CERT: God Mode On - Researchers run Doom on a vehicle's head unit after remotely attacking its modem (UNISOC UIS7862A, CVE-2024-39432) Kaspersky · Research · 2025-11-20
• Securelist: A vehicle's head unit hacked via its modem Kaspersky Securelist · Research · 2025-11-20
• Zimperium: Video Call Exploit Chain Exposes Android Devices to Kernel-Level Access zimperium.com · Blog · 2026-08-28
• Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access The Hacker News · News · 2026-08-17
• UNISOC Modem Flaw Enables Remote Code Execution via Video Calls infosecurity-magazine.com · News · 2026-08-18
• Video Call Exploit Chains Two Flaws in Unisoc Modems Dark Reading · News · 2026-08-18

Threats related to Unisoc VoLTE kernel escape

• Unisoc VoLTE Video-Call Exploit Chain Escalates Modem RCE to Full Android Kernel Access
• Unisoc VoLTE Video Call Exploit Chain Grants Full Android Kernel Access
• CVE-2026-64561 — Zapscape: KVM/x86 Shadow MMU Use-After-Free Allows L1 Guest Escape to Linux Host
• Google Chrome 151 Update Fixes 41 Security Vulnerabilities, Including 6 Critical Flaws
• CVE-2026-20212: Critical Unauthenticated RCE in Cisco Nexus 9000 Series Switches (Silicon One ASIC)

Related coverage of this activity

• isolated-vm sandbox escape
• Zscaler Client Connector RCE flaws
• Zoomsday Zoom annotation flaws
• SCTPhantom Linux kernel privilege escalation
• Linux IPv6 fragmentation escape

Previous and next in vulnerability

• Pre-Authentication Remote Code Execution in SPIP CMS (CVE-2026-77806) — Actively Exploited Previous report
• HardBreacher PoC Exploit Targets Kaspersky Endpoint Security Zero-Day for Windows 11 Local Privilege Escalation Next report