# Unisoc T612/T606/T7250 Modem Exploit Chain: Malicious VoLTE Video Call Enables Full Android Kernel Access (CVE-2025-31718 + Unpatched MPU Privilege Escalation)

> Independent researcher 0x50594d, via SSD Secure Disclosure, chained an SDP/SIP parsing RCE in UNISOC modem firmware (CVE-2025-31718, CVSS 7.5) with a second, unpatched and CVE-less privilege-escalation flaw (CWE-1189) that disables ARM Memory Protection Unit region-0 isolation, giving modem-context code full read/write/execute access to Android kernel memory. A single answered VoLTE video call over attacker-controlled 4G/IMS infrastructure is enough to trigger the full chain; UNISOC has not responded to disclosure and no patch exists.

- **Published:** 2026-08-29T00:00:00Z
- **Last reviewed:** 2026-08-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2223
- **ID:** TL-2026-2223
- **Severity:** HIGH (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-31718, CVE-2025-31717

## Description

The exploit chain targets budget Android devices built on UNISOC's T606, T612, T616 and T7250 modem chipsets and unfolds in two stages, disclosed roughly five months apart by SSD Secure Disclosure. To build and validate the chain, the researcher stood up an attacker-controlled cellular test network in the lab: an Open5GS open-source 4G/EPC core paired with a Kamailio SIP server for signaling, a LimeSDR software-defined radio as the 4G air interface, and specialized SIM cards. Network authentication to this rogue IMS/VoLTE network was scripted with a custom Python exploitation tool implementing the 3GPP Milenage algorithm and AKAv1-MD5 authentication vectors, so the only real-world prerequisite is that the attacker be a registered IMS/VoLTE subscriber able to place a video call to the victim over 4G.

Stage 1 (published 2026-03-11 as the 'UNISOC T612 RCE' advisory, tracked as CVE-2025-31718, CVSS 3.1 base score 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is a remote code execution bug in the modem's SIP/SDP signaling parser. The vulnerable function, _SDPDEC_AcapDecoder, looks up each SDP attribute name in the SipHandler_AttrDecoder dispatch table and invokes the matching handler; because 'acap' is itself an entry in that table, an SDP line containing repeated 'acap' attributes recurses into itself with no depth limit (CWE-674, Uncontrolled Recursion), consuming the stack. An attacker who is authenticated to an IMS/VoLTE network sends a crafted SIP INVITE containing this malformed SDP body (PoC: a line of the form 'a=acap:1 acap:1 acap:1 ...' repeated); when the victim initiates or answers a video call, SRTP packet fragmentation drives execution such that the SIP task's stack collides with an adjacent modem task's stack during the overflow, corrupting adjacent function pointers and yielding arbitrary native code execution inside the modem processor (ARM Cortex-R7 core; both stages' shellcode is compiled with -mcpu=cortex-r7 and largely written in ARM Thumb-mode). Researchers demonstrated a controlled write primitive via the SDP 'crypto' attribute, confirming stack control by writing the marker value 0xdeadbeef to address 0x8d0f270c and observing r1/r2 holding that address/value pair in a modem register/memory dump. Notably, NVD's own summary of CVE-2025-31718 states the flaw could lead to "remote escalation of privilege with no additional execution privileges needed" even though UNISOC's submitted CVSS vector scores it as availability-only (C:N/I:N/A:H, i.e. a crash/DoS) -- a real-world severity understatement, since SSD's research demonstrates the same root cause achieves full arbitrary code execution rather than a mere crash. This stage alone was independently disclosed by UNISOC in an October 2025 security bulletin (CWE-20, Improper Input Validation) -- which also covers a related but distinct denial-of-service sibling flaw, CVE-2025-31717 -- affecting a wider chipset family (T606, T612, T616, T750, T760, T765, T770, T820, S8000, T8300, T9300) running Android 13 through 16; UNISOC provided no patch guidance beyond directing OEMs to its support portal.

Stage 2 (published 2026-08-17 as the 'UNISOC T612 LPE' advisory, no CVE assigned) escalates from modem-context code execution to full Android kernel access. The modem shellcode delivered in Stage 1 uses an 'egg hunter' routine -- scanning forward from a base address of 0x8cbf469c for a marker value, then backtracking to the start of each chunk -- to locate payload fragments (0x4b0-byte chunks separated by 0x1bc-byte gaps) scattered across the modem heap during delivery and reassembles them at address 0x8de00000. It then executes an ARM coprocessor instruction sequence that fully disables the hardware isolation boundary between modem and application-processor memory: `MOV r0,#0x0` / `MCR p15,0,r0,c6,c2,0` / `DSB` to disable MPU region 0, followed by `MOV r0,#0x10b` / `MCR p15,0,r0,c6,c1,4` / `ISB` / `DSB` to reconfigure that region as full read-write-execute, mapping the entire 32-bit physical address space (base 0x00000000, span 0x100000000) as RWX from modem context -- including the kernel's base at the modem-mapped physical address 0x80080000. The exploit then copies kernel shellcode into the kernel's __arm64_compat_sys_vmsplice function (kernel virtual address 0xffffffc0104f6b58, reachable from modem context at its RWX-mapped physical equivalent 0x804f6b58) and patches the do_sys_open syscall (kernel virtual address 0xffffffc0104adb00, modem-mapped equivalent 0x804adb00) with a trampoline branch instruction that redirects execution into the planted shellcode. A mutex placed at the kernel's __bss_stop symbol (kernel virtual address 0xffffffc0121640e0, modem-mapped equivalent 0x821640e0) is checked with a simple `if (*mutex == 1) { return; }` guard to block the payload from re-triggering on subsequent calls to the same syscall and crashing the device. Researchers confirmed full kernel-level code execution by redirecting do_sys_open into a call to the kernel's own printk function (kernel virtual address 0xffffffc0102ee85c) with the string "Exploit worked !", observed in the device's dmesg/kernel log. Root cause is classified CWE-1189, Improper Isolation of Shared Resources on a System-on-a-Chip -- an architectural defect, not a single fixable code bug, since the modem and application processor share physical memory with no hardware-enforced boundary.

SSD Secure Disclosure confirmed the full two-stage chain works against a Motorola Moto E13 (T606) on the February 2025 Android security patch level, a Realme C33 (T612, modem firmware build MOCORTM_22A_W23.02.5_P12.14_Debug) on the July 2025 Android security update, and a Xiaomi Redmi A5 (T7250) on the January 2026 security patch level -- the researcher explicitly cautions this is not an exhaustive device list. UNISOC has not responded to multiple disclosure attempts via email and LinkedIn, has not issued a patch or workaround, and neither its own advisories nor the August 2026 Android Security Bulletin address the Stage 2 flaw. There is no evidence of in-the-wild exploitation, and CVE-2025-31718 does not appear in CISA's Known Exploited Vulnerabilities catalog as of 2026-08-29; the chain is currently PoC-only.

This is not an isolated architectural lapse for UNISOC. In May 2022, Check Point Research disclosed CVE-2022-20210 (CVSS 9.4), a NAS-message-parsing flaw in UNISOC's baseband stack allowing remote crash and potential code execution across smartphones and smart TVs; UNISOC patched it within about a month of disclosure -- a markedly faster response than the current chain has received. More significantly, in November 2025 Kaspersky ICS CERT published 'God Mode On,' documenting an analogous modem-to-kernel escape (stack-based buffer overflow in the 3G RLC protocol stack, CVE-2024-39432) on UNISOC's UIS7862A chipset used in automotive head units, again pivoting from modem code execution to full application-processor control via the same class of shared, unprotected physical memory between modem and host -- including a hidden DMA peripheral offering an additional lateral-movement path that Kaspersky assessed as unfixable in software. Read together, these three UNISOC disclosures (2022, 2025, 2026) show a recurring, cross-product architectural weakness in how UNISOC isolates (or fails to isolate) modem firmware from the host processor, spanning smartphones, smart TVs, and now vehicle infotainment systems.

## MITRE ATT&CK

- T1588.006 Vulnerabilities
- T1587.004 Exploits
- T1588.002 Tool
- T1664 Exploitation for Initial Access
- T1203 Exploitation for Client Execution
- T1211 Exploitation for Stealth
- T1620 Reflective Code Loading
- T1574 Hijack Execution Flow
- T1601.001 Patch System Image
- T1499.004 Application or System Exploitation

## Sources

- [Zimperium: Video Call Exploit Chain Exposes Android Devices to Kernel-Level Access](https://zimperium.com/blog/mobile-threat-watch/video-call-exploit-chain-exposes-android-devices-to-kernel-level-access)
- [Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access](https://thehackernews.com/2026/08/unisoc-volte-video-call-exploit-chain.html)
- [UNISOC T612 RCE (Stage 1 advisory)](https://ssd-disclosure.com/unisoc-t612-rce/)
- [UNISOC T612 LPE (Stage 2 advisory)](https://ssd-disclosure.com/unisoc-t612-lpe/)
- [UNISOC Modem Flaw Enables Remote Code Execution via Video Calls](https://www.infosecurity-magazine.com/news/unisoc-modem-flaw-rce-calls/)
- [NVD - CVE-2025-31718 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-31718)
- [UNISOC Security Announcement (CVE-2025-31718, CVE-2025-31717)](https://www.unisoc.com/en/support/announcement/1976557615080263681)
- [Video Call Exploit Chains Two Flaws in Unisoc Modems](https://www.darkreading.com/mobile-security/video-call-exploit-chains-two-flaws-unisoc-modems)
- [Check Point Research: Vulnerability within the UNISOC baseband opens mobile phones communications to remote hacker attacks (CVE-2022-20210)](https://research.checkpoint.com/2022/vulnerability-within-the-unisoc-baseband/)
- [Kaspersky ICS CERT: God Mode On - Researchers run Doom on a vehicle's head unit after remotely attacking its modem (UNISOC UIS7862A, CVE-2024-39432)](https://ics-cert.kaspersky.com/publications/reports/2025/11/20/god-mode-on-researchers-run-doom-on-a-vehicles-head-unit-after-remotely-attacking-its-modem/)
- [Securelist: A vehicle's head unit hacked via its modem](https://securelist.com/attacking-car-modem/118463/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2223