Unisoc Modem Flaw Allows Remote Code Execution via VoLTE Video Calls

Security researchers at SSD Secure Disclosure have uncovered a critical vulnerability in Unisoc modem firmware that allows for remote code execution (RCE) via malicious VoLTE video calls. The flaw targets the baseband processor—the specialized hardware responsible for cellular connectivity—effectively bypassing traditional operating system security layers.

The attack is triggered when a device receives a VoLTE video call containing malformed Session Description Protocol (SDP) data embedded within SIP INVITE messages. Technical disclosures reveal the vulnerability stems from an Uncontrolled Recursion condition (CWE-674) located in the `_SDPDEC_AcapDecoder` function of the modem firmware. This flaw allows an attacker to trigger a stack overflow in the modem's SIP/SDP parsing path, granting the ability to execute arbitrary code directly within the baseband.

Affected Hardware and Reach

The vulnerability impacts several Unisoc System-on-Chips (SoCs), specifically the T612, T616, T606, and T7250 models. Unisoc is a significant global semiconductor supplier, providing chipsets to a wide array of major original equipment manufacturers (OEMs), including Samsung, Motorola, vivo, realme, and Honor. Because the flaw resides in the baseband stack—which operates independently and below the Android OS boundary—standard Android security patches cannot mitigate the risk.

Industry Implications

The severity of this exploit lies in its delivery mechanism. Because the attack is transmitted via the cellular signaling plane, it can be executed remotely. In many scenarios, this requires minimal to no user interaction beyond answering a call. Baseband compromises are particularly dangerous because the modem often has direct access to hardware components like the microphone, camera, and GPS, potentially allowing for covert surveillance that remains invisible to the user and traditional mobile security software.

Current Status

While the technical details of the RCE have been disclosed, the full extent of the exploit chain remains under scrutiny. Some reports suggest the vulnerability could be used to escalate privileges from the modem to the Android kernel, though this specific claim has not been independently verified across all technical disclosures.

Cyberpress, reporting on the SSD Secure Disclosure findings, noted that in the absence of patches or public advisories from the vendor, devices using the affected firmware remain exposed to remote, baseband-level compromise via a malicious cellular video call from any reachable number.