Security researchers have uncovered a dangerous two-stage attack chain in Unisoc T612 modems that allows hackers to gain full kernel access to Android devices via a simple video call.
- Attackers can gain privileged Android kernel access by chaining two Unisoc T612 modem flaws.
- The exploit requires the victim to answer a malicious video call after a payload is delivered.
- Affected devices include models from Realme, Xiaomi, and Motorola using Unisoc chipsets.
In a startling revelation for mobile security, researchers at SSD Secure Disclosure have demonstrated a sophisticated attack chain targeting the Unisoc T612 modem. By combining a previously known Remote Code Execution (RCE) vulnerability with a newly discovered memory-isolation weakness, threat actors can effectively bypass security boundaries to take control of an Android device's kernel.
The attack operates in two distinct stages. First, the adversary delivers a malicious payload to the device's modem using a flaw in the handling of Session Initiation Protocol/Session Description Protocol (SIP/SDP) data. This initial breach allows the attacker to place fragments of malicious code within the modem's memory. The second stage is triggered when the attacker places a video call; if the victim answers, the fragmented payload is reassembled and executed, disabling memory protections and granting the attacker high-level kernel privileges.
Why This Matters
BozokMedia analysis shows that this exploit highlights a critical systemic weakness in how cellular modems—often treated as "black boxes"—interact with the main operating system. Because modems have direct access to hardware and often run proprietary firmware with less scrutiny than the Android OS itself, they represent a massive, remotely reachable attack surface. This vulnerability proves that even a basic user action, like answering a call, can lead to a total device compromise.
The chaining of modem-level RCE with kernel-level privilege escalation transforms a minor firmware bug into a catastrophic security failure.
The researchers validated this exploit on several devices, including the Realme C33, Xiaomi Redmi A5 (January 2026 patch), and Motorola E13 (February 2025 patch). Despite multiple attempts to contact Unisoc Technologies Co. Ltd. via email and LinkedIn, the Chinese semiconductor giant has reportedly remained silent, leaving millions of users potentially exposed.
Historically, modem vulnerabilities have been a recurring nightmare for mobile security. From Google Project Zero's findings on Samsung Exynos modems to Check Point's reports on Unisoc basebands, the industry has seen a pattern of "zero-click" or "low-interaction" exploits that bypass traditional app-level security. The T612 exploit is particularly alarming because it leverages the very protocols (SIP/SDP) designed to facilitate communication.
| Attack Stage | Vulnerability Used | Result |
|---|---|---|
| Stage 1: Delivery | SIP/SDP RCE | Payload placed in modem memory |
| Stage 2: Execution | Memory Isolation Flaw | Android Kernel Access |
Frequently Asked Questions
Q: Which phones are affected by this Unisoc exploit?
A: Devices using the Unisoc T612 chipset, including specific models from Realme, Xiaomi, and Motorola, are confirmed to be vulnerable.
Q: Can this attack happen without me answering the call?
A: According to SSD Secure, the final stage of this specific exploit chain requires the victim to answer the video call to reassemble and execute the payload.
