Security researchers have uncovered a critical vulnerability in several Unisoc system-on-chip (SoC) platforms that could allow attackers to gain unauthorized root access to targeted budget Android smartphones. The exploit is delivered via malicious code transmitted during video call setup messages, enabling arbitrary code execution directly through the device’s modem firmware.
Unisoc ranks as the world’s fourth-largest mobile chip designer, behind MediaTek, Qualcomm, and Apple. Its processors frequently power entry-level and budget-friendly devices from mainstream brands, including Motorola, Xiaomi, and Realme.
The research, documented by a security researcher using the alias 0x50594d and published on the SSD Secure Disclosure platform, classifies the flaw as an “Improper Isolation of Shared Resources on System-on-a-Chip.”
According to the disclosure, an attacker who executes code within the modem can disable protections on the primary Memory Protection Unit (MPU region 0). This allows unrestricted read-and-write access across the device’s entire memory space with kernel-level privileges.
The firmware vulnerability affects at least four major Unisoc processors:
- Unisoc T606
- Unisoc T612
- Unisoc T616
- Unisoc T7250
The researcher successfully demonstrated the proof-of-concept attack across three specific budget smartphone models running older security patch levels: the Realme C33, the Motorola E13, and the Xiaomi Redmi A5.
While the exploit presents serious architectural implications, real-world risks are mitigated by the specific conditions under which the vulnerability was demonstrated. The tests were conducted exclusively on rooted smartphones connected to an isolated, closed VoLTE network rather than standard live carrier infrastructure. These prerequisites lower the immediate threat level for mainstream consumers running stock, unmodified devices on commercial cellular networks.
Despite official security notifications submitted regarding the modem firmware flaw, Unisoc has not issued a public response or confirmed timeline for remediation patches.
Filed in . Read more about Motorola, Realme, Redmi, Security and Xiaomi.