Unisoc T606/T612/T7250 modems: a single answered video call can escalate from modem-level RCE to full Android kernel access via an ARM Memory Protection Unit isolation bypass — no CVE, no patch, vendor unresponsive
Independent researcher 0x50594d, via SSD Secure Disclosure, chained two flaws in Unisoc modem firmware shared across the T606, T612 and T7250 chipsets — confirmed on the Motorola E13 (T606), Realme C33 (T612) and Xiaomi Redmi A5 (T7250), though SSD does not present this as an exhaustive device list. Stage one, disclosed earlier in March 2026, is a memory-corruption bug in the modem's handling of SIP/SDP messages during VoLTE call setup, giving remote code execution inside the modem processor. Stage two, the new SSD finding, is an uncontrolled-recursion flaw (CWE-674) that lets code already running in the modem write a full-access configuration to the ARM Memory Protection Unit via coprocessor registers: "the new flaw that SSD Security discovered is a memory-isolation weakness in Unisoc's T612 modem's memory protection unit. The firmware flaw allows an attacker who already has access to the modem to escalate privileges and gain kernel level privileges on an affected Android device" (Dark Reading, citing SSD Secure Disclosure, 2026-08-17).
The MPU is the only hardware boundary separating modem memory from the application processor's memory, including memory used by the Android kernel; Unisoc's design shares that physical memory space between the two processors with no independent hardware enforcement beyond it. The overall attack requires an attacker-controlled position on the 4G/VoLTE network able to deliver the malformed SIP/SDP payload during call setup, and the victim simply answering an incoming video call — no other user interaction. CWE-1189 (Improper Isolation of Shared Resources on a System-on-a-Chip) is the classification given for the combined chain. No CVE identifier has been assigned, and no firmware update or mitigation is available: "the disclosure does not identify a vendor firmware update addressing the flaw" (Infosecurity Magazine, citing SSD Secure Disclosure, 2026-08-17). Unisoc did not respond to SSD's disclosure attempts, and device owners have no interim control beyond watching for a manufacturer firmware update.
Unisoc chips are concentrated in budget-tier Android devices, a segment with weaker patch cadence and longer field life; this is relevant to any BYOD or public-sector device fleet that includes low-cost handsets. actions[] is left empty deliberately: no vendor fix or interim mitigation exists, and the only defender-facing lever — device-fleet composition — is a standing inventory question rather than a do-now task this specific disclosure changes. The transferable lesson for a device-procurement or BYOD policy is that chipset-level isolation defects can sit below any control the device's own OS vendor can patch, since the flaw is in modem firmware Unisoc alone controls, not in Android itself.
The new flaw that SSD Security discovered is a memory-isolation weakness in Unisoc's T612 modem's memory protection unit. The firmware flaw allows an attacker who already has access to the modem to escalate privileges and gain kernel level privileges on an affected Android device.
The disclosure does not identify a vendor firmware update addressing the flaw.
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Privilege Escalation TA0004
T1068Exploitation for Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Lateral Movement TA0008
T1210Exploitation of Remote Services
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.