Loading story…
Researchers disclosed a two-stage exploit chain in Unisoc modem firmware that can turn a VoLTE video call into full Android kernel access on vulnerable devices. The attack combines a previously published remote code execution flaw in the UNISOC T612 modem stack with a newly revealed privilege-escalation weakness caused by inadequate isolation between the modem and application processor. After a target answers an incoming video call, code running in the modem context can map and alter kernel memory because both components share physical memory without a hardware-enforced boundary.
SSD Secure Disclosure said the issue was validated on devices including the Motorola E13 and Xiaomi Redmi A5, and reported that the flaw has no CVE, no vendor response, no patch, and no published mitigation. The attack is not trivial because it requires the adversary to operate a private 4G network, but the technique echoes prior modem-to-system compromise research, including Kaspersky ICS CERT’s demonstration of remotely pivoting from a vehicle modem into a head unit. Neither the August 2026 Android Security Bulletin nor any UNISOC bulletin reportedly addresses the newly disclosed escalation bug.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-17, SSD Secure Disclosure published a second-stage privilege-escalation exploit affecting vulnerable Unisoc modem firmware that can achieve full Android kernel access via a VoLTE video call. The issue stems from improper isolation of shared SoC resources, and SSD said Unisoc had not responded to outreach and that no CVE, patch, mitigation, Android bulletin entry, or Unisoc bulletin covered the flaw at disclosure time.
In March 2026, SSD Secure Disclosure disclosed the first stage of the exploit chain: a remote code execution vulnerability in Unisoc modem firmware triggered through a malformed SIP video call. This modem-side RCE later became the initial stage used in the full exploit chain.
In November 2025, Kaspersky ICS CERT published research on the Unisoc UIS7862A used in vehicle head units, describing the shared physical memory architecture between the modem and application processor. It also demonstrated that after achieving modem code execution through a separate flaw, an attacker could modify the running Android kernel.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourceinfosecurity-magazine.com
Open sourcethehackernews.com
Open sourcessd-disclosure.com
Open sourceics-cert.kaspersky.com
Open sourcessd-disclosure.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers and vendors reported **hardware/firmware-level vulnerabilities in Android chip components** that can enable deep device compromise beyond typical app-layer defenses. Ledger’s Donjon research described a flaw involving **MediaTek chip boot-chain behavior and Trustonic’s trusted execution environment (TEE)** that allowed rapid physical compromise: by connecting an affected phone to a laptop over **USB**, attackers could allegedly brute-force the PIN, decrypt storage, and extract sensitive data including messages and **cryptocurrency wallet seed phrases** (e.g., Kraken Wallet, Phantom). The researchers estimated the affected MediaTek chips appear in roughly **one-quarter of Android phones**, disproportionately in lower-cost devices. Separately, Zimperium reported active exploitation of a **Qualcomm graphics zero-day** (**CVE-2026-21385**) in targeted Android attacks, describing a memory-corruption condition that could enable code execution or unauthorized access across “hundreds” of Qualcomm chipsets. A ZDNET article on Android’s *Repair Mode* primarily provides user guidance and anecdotal troubleshooting around a buggy March update/SIM recognition issue; it does not substantively address the chip-level vulnerabilities described in the other reporting and is best treated as tangential consumer advice rather than incident or vulnerability intelligence.
Jun 29, 2026
Researchers from the University of Birmingham and Fuzzware disclosed that malicious or compromised SIM cards can abuse standards-compliant SIM Toolkit features, including **Proactive SIM** and `RUN AT`, to send AT commands directly to modems in some smartphones and cellular IoT devices. Testing with the **CATana** toolkit found exposed SIM-to-modem command interfaces on a subset of 26 devices, including multiple Qualcomm-based and Quectel-powered designs, enabling attacks such as arbitrary file reads, denial of service, forced shutdowns, persistent downgrades from **5G to 2G**, and in some cases code execution. Demonstrated targets included an **Autel EV charger** using a Quectel `EC25-AFX` module, an **OPPO Reno14 F 5G**, and a **Quectel EG25-G** modem. The broader modem interface issue is being tracked as **`CVE-2026-57550`** and **GSMA `CVD-2026-0122`**, while a related Android flaw that let a hostile SIM open an attacker-controlled website without user interaction was tracked as **`CVE-2025-48618`** and patched by Google for Android 13 through 16 in December 2025. Qualcomm said it offers a hardened configuration that disables the SIM AT interface by default, and Quectel said it mitigated one file-access flaw and had fixed command injection in newer firmware. The researchers warned that vendor-by-vendor fixes may not be enough and urged deprecation of the `RUN AT` feature to reduce the attack surface across phones, EV chargers, industrial routers, and vehicle telematics systems.
Aug 14, 2026
MediaTek disclosed two high-severity modem vulnerabilities, **CVE-2026-20432** and **CVE-2026-20433**, that stem from out-of-bounds writes caused by missing bounds checks in affected modem components. The flaws can allow **remote privilege escalation** when a user equipment device connects to a **rogue base station** controlled by an attacker, potentially exposing confidentiality, integrity, and availability to high impact. Both issues are classified as `CWE-787` and carry severe CVSS v3.1 ratings, with vectors `AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` for CVE-2026-20432 and `AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` for CVE-2026-20433. The vulnerabilities were published through MediaTek’s April 2026 product security bulletin and tracked internally as **MSV-4461** and **MSV-4460**. MediaTek linked the issues to patch identifiers **MOLY01406170** for CVE-2026-20432 and **MOLY01088681** for CVE-2026-20433, indicating that remediation is available for impacted products. Organizations using Huawei devices or other equipment built on affected MediaTek modem components should prioritize vendor patch validation and assess exposure to baseband-level attacks involving malicious cellular infrastructure.
Jun 29, 2026