realme

A vulnerability in UNISOC modem firmware can allow arbitrary code execution with kernel privileges from the modem context, potentially allowing an attacker to modify Android kernel code. The flaw stems from a lack of isolation between modem memory and kernel memory. This is according to new research by the SSD Secure Disclosure technical team, which was credited to independent security researcher 0x50594d. The firm demonstrated a full exploit chain in which modem-level code execution was extended into kernel-level execution. The issue has been identified in phones using UNISOC chipsets, with SSD listing the Xiaomi Redmi A5 with a January 1, 2026 security patch and the Motorola E13 with a February 1, 2025 security patch among affected devices. SSD classified the underlying flaw as Improper Isolation of Shared Resources on System-on-a-Chip (SoC), tracked as Common Weakness Enumeration (CWE) 1189. The researchers said the missing isolation allows code running in the modem context to access memory used by the Android kernel. Modem Isolation Failure Enables Kernel Access The vulnerability allows an attacker who has already gained code execution on the modem to disable protections on a Memory Protection Unit (MPU) region. This gives the modem context access to physical memory, including memory used by the Android kernel. SSD tested the full chain against a Realme C33 with an Android security update from July 2025. The disclosure links the test to a previously disclosed UNISOC T612 RCE and demonstrates the resulting execution of a payload in kernel space. The final stage was triggered by placing a video call to the target phone. The researchers used a Voice over Long-Term Evolution (VoLTE) connection in their test environment, demonstrating how modem-level execution could be extended to kernel-level code execution. No UNISOC Response Reported The disclosure does not identify a vendor firmware update addressing the flaw. SSD also does not present its listed devices as an exhaustive inventory of affected phones. For affected device owners, the disclosure leaves firmware updates from UNISOC and handset manufacturers as the key route to remediation. Similar risks have been demonstrated in other cellular modem components, including Cinterion modem vulnerabilities in 2024 that researchers said could allow remote attackers to execute arbitrary code and manipulate device memory. SSD said it attempted to contact UNISOC through email and LinkedIn. Infosecurity has also contacted UNISOC for comment but has not received a response at the time of writing. UNISOC (Shanghai) Technologies is a top-three global fabless semiconductor company headquartered in Shanghai, specializing in 2G/3G/4G/5G mobile communication, IoT and smart device chipsets.

Security researchers at SSD Secure Disclosure have published a two-stage exploit chain that achieves full Android kernel access on devices running Unisoc modem firmware through a VoLTE video call, with no fix from the chipset maker. The advisory, published August 17, 2026, is the second stage of a chain that began in March 2026, when SSD disclosed remote code execution in the same firmware through a malformed SIP video call. Completing the full chain requires the attacker to control a private 4G cellular network and the victim to answer the incoming video call. "We have tried to reach out to the vendor through multiple channels (email and LinkedIn) but have not been able to receive any response," SSD Secure Disclosure said in its advisory. The March 2026 disclosure carried the same statement. The research was carried out by an independent security researcher using the handle 0x50594d. The privilege-escalation vulnerability is classified as CWE-1189, Improper Isolation of Shared Resources on System-on-a-Chip, and no CVE identifier has been assigned as of publication. The flaw resides in the modem firmware shared by at least three Unisoc chipsets, among them the T606 found in the Motorola E13, the T612 found in the Realme C33, and the T7250 found in the Xiaomi Redmi A5. Unisoc, a Shanghai-based chipmaker formerly known as Spreadtrum, supplies components to brands including Motorola, Realme, and Xiaomi for devices sold across more than 140 countries, according to the advisory. Researchers confirmed the privilege-escalation flaw on a Motorola E13 carrying a February 2025 security patch and on a Xiaomi Redmi A5 carrying a January 2026 patch. Running the complete chain requires a modem-level foothold from the March 2026 RCE vulnerability first, along with attacker-controlled VoLTE infrastructure and a victim who answers the incoming video call. The researchers built their proof-of-concept environment using an open-source 4G core network, a software-defined radio for the 4G radio interface, and specialized SIM cards. Once code is running on the modem, the privilege-escalation step works by writing a full-access configuration to the modem's ARM Memory Protection Unit through coprocessor registers, mapping the entire 32-bit physical address space as readable, writable, and executable from modem context, including the pages where the Android kernel resides. The condition making this possible is a shared physical memory space between the modem processor and the application processor within the Unisoc SoC, with no hardware-enforced boundary preventing modem-context code from modifying kernel memory. Researchers confirmed kernel-level code execution on a test device by observing kernel log output showing that the injected payload had run. The August 2026 Android Security Bulletin, published before this disclosure, does not address the privilege-escalation vulnerability, and no UNISOC security bulletin covers it. A separate UNISOC advisory from October 2025, CVE-2025-31718 (CVSS score: 7.5), describes a modem input-validation flaw on the same chipset family, though it's not clear whether it corresponds to the March 2026 SSD disclosure. Device owners currently have no available patch or mitigation and should watch for a firmware update from their device manufacturer. The disclosure follows independent research published in November 2025 by Kaspersky ICS CERT, which documented the same architectural condition on a different Unisoc chip, the UIS7862A, found in vehicle head units. After gaining modem code execution via a separate vulnerability, the Kaspersky team was also able to reach and modify the running Android kernel by exploiting the modem and application processor's shared physical address space. Kaspersky described one of its lateral movement paths, involving a hidden Direct Memory Access peripheral, as a hardware-level issue not fixable through a software update. The Memory Protection Unit route used in the SSD chain is in principle addressable through a firmware change, though no such update has been committed to by UNISOC. A coordinated Unisoc modem vulnerability uncovered by Check Point Research in 2022, CVE-2022-20210, was patched by UNISOC and distributed through the Android Security Bulletin. The two currently disclosed vulnerabilities carry no such assurance.