Critical UNISOC T612 Modem Flaw Enables Remote Code Execution via Cellular Calls
A significant security vulnerability has been identified in UNISOC modem firmware, enabling attackers to remotely execute arbitrary code over cellular networks.
A significant security vulnerability has been identified in UNISOC modem firmware, enabling attackers to remotely execute arbitrary code over cellular networks.
UNISOC manufactures chipsets used in mobile devices from brands such as Motorola, Samsung, Vivo, and Realme. This vulnerability potentially affects millions of devices.
The vulnerability enables an attacker to compromise a device by initiating a cellular call. By sending specially crafted Session Description Protocol (SDP) messages during Session Initiation Protocol (SIP) signaling, an attacker can trigger memory corruption in the modem of the target device.
This issue is classified as an Uncontrolled Recursion problem, tracked as CWE-674 in the Common Weakness Enumeration system. The vulnerability arises from improper handling of specific message attributes by the modem without adequate validation.
The vulnerability is traced to the _SDPDEC_AcapDecoder function, which handles the acap attribute in SDP messages. The unsafe parsing logic allows the decoder function to call itself recursively without limits.
UNISOC manufactures chipsets used in mobile devices from brands such as Motorola, Samsung, Vivo, and Realme.
An attacker can exploit this by sending input with multiple acap attributes on a single line, causing the modem to overflow the SIP task's stack. This results in memory collision with the sblock_0_2 task.
For successful exploitation, the sblock_0_2 task must be active, typically during high-bandwidth operations such as video calls. Additionally, a crypto attribute allows the adversary to overwrite critical function pointers and achieve remote code execution.
The attack was demonstrated by security researcher 0x50594d and SSD Secure Disclosure in a controlled environment using a Dockerized Open5GS deployment and a LimeSDR antenna for 4G communication with a target smartphone.
The exploit affects several UNISOC chipsets, including T612, T616, T606, and T7250 models. Testing confirmed the vulnerability on a Realme C33 smartphone with the July 2025 Android security update.
Attempts to contact UNISOC for a patch have been unsuccessful, leaving devices using these modems vulnerable to unauthorized remote code execution.
Based on reporting by GBHackers.