As reported by The Hacker News, SSD Secure Disclosure has published the second stage of an exploit chain targeting Unisoc modem firmware that achieves full Android kernel access through a VoLTE video call. The advisory details a privilege-escalation flaw rooted in improper isolation of shared resources on the System-on-a-Chip — a hardware architecture problem, not a simple software bug — and Unisoc has reportedly not responded to repeated disclosure attempts spanning six months.
This is not a typical patch-and-move-on vulnerability. The flaw stems from a shared physical memory space between the modem processor and the application processor within the Unisoc SoC, with no hardware-enforced boundary preventing modem-context code from modifying Android kernel memory. That means even if Unisoc eventually ships a firmware update, the underlying architectural weakness may persist across chipset generations unless the silicon itself is redesigned.
Vulnerability Details
| CVE ID | Not assigned as of publication |
| Severity | Critical (kernel-level R/W/X; full device compromise) |
| CWE | CWE-1189 — Improper Isolation of Shared Resources on System-on-a-Chip |
| Affected Vendor | Unisoc (formerly Spreadtrum), Shanghai-based |
| Affected Chipsets | T606, T612, T7250 (confirmed); potentially broader |
| Confirmed Devices | Motorola E13 (Feb 2025 patch), Xiaomi Redmi A5 (Jan 2026 patch) |
| Other Likely Devices | Realme C33 (T612) and similar budget-tier Android phones |
| Patch Available | No — vendor has not responded to disclosure |
| Active Exploitation | None publicly reported; proof-of-concept published |
| Attack Prerequisites | Attacker-controlled 4G network (SDR + open-source core), victim answers VoLTE video call, modem-level foothold via March 2026 RCE |
Why This Matters
The attack chain requires significant infrastructure — a rogue 4G base station using software-defined radio and a private core network. This naturally limits mass exploitation but makes the technique ideal for targeted surveillance against high-value individuals: journalists, activists, executives, or government officials who carry budget Android devices as secondary or travel phones. The fact that no user interaction beyond answering a video call is required makes this a potent tool for nation-state or well-resourced threat actors.
The real story here is supply chain accountability. Unisoc ships chips to brands serving 140+ countries, primarily in budget-tier devices. When a chipset vendor with that footprint simply stops responding to security researchers, every downstream OEM and end user is left holding the risk.
Budget Android devices are disproportionately used by price-sensitive populations in emerging markets, where they may serve as primary — not secondary — phones. These users are least likely to receive timely firmware updates even when patches exist, and in this case, no patch exists at all.
Broader Implications
Who Is at Risk
- Users of budget Android devices powered by Unisoc T606, T612, or T7250 chipsets — particularly Motorola E13, Realme C33, and Xiaomi Redmi A5
- Individuals in roles susceptible to targeted surveillance who may use these devices as travel or burner phones
- Organizations with BYOD policies where employees carry low-cost Android devices accessing corporate resources
- Populations in emerging markets where these devices are primary phones and update cycles are slow or nonexistent
Shield53 Recommendations
Immediate Actions
- Do not answer VoLTE video calls from unknown or unexpected numbers on any Unisoc-powered device. This is the primary user-level mitigation until a firmware fix is available.
- Identify at-risk devices in your fleet. Inventory Android devices by chipset. Tools like AIDA64 or CPU-Z can identify the SoC. Flag any device running Unisoc T606, T612, or T7250.
- Disable VoLTE where feasible on identified devices if cellular data voice services are not operationally required. This reduces the attack surface, though it may affect call quality.
- Restrict sensitive data access on confirmed Unisoc devices. Move high-risk users to devices with Qualcomm or Samsung Exynos modems if targeted attack is a credible threat.
- Monitor for rogue cell towers. Deploy or recommend Android-based IMSI catcher detection apps (e.g., SnoopSnitch) for high-risk individuals. While not a complete defense, they can alert users to suspicious cellular infrastructure.
Strategic Actions
- Add chipset vendor to device procurement risk assessments. Include patch history, disclosure responsiveness, and hardware isolation architecture as evaluation criteria alongside price and performance.
- Establish a mobile threat model for targeted users. Executives, field staff, and high-profile personnel should have guidance on device selection, cellular attack awareness, and behavioral mitigations.
- Track this advisory for CVE assignment and patch availability. SSD Secure Disclosure and Unisoc should be monitored for updates. If a CVE is eventually assigned, prioritize it immediately.
Until Unisoc acknowledges and addresses this flaw — both the immediate privilege escalation and the deeper architectural issue of shared memory without hardware isolation — the safest assumption is that any Unisoc-powered device in your environment is one answered video call away from full compromise, given the right attacker and proximity.
