{"id":76823,"date":"2026-08-18T06:08:25","date_gmt":"2026-08-18T10:08:25","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=76823"},"modified":"2026-08-18T06:08:25","modified_gmt":"2026-08-18T10:08:25","slug":"unisoc-modem-bug-hijack","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/unisoc-modem-bug-hijack\/","title":{"rendered":"Unisoc Modem Bug Lets Attackers Hijack Android via Video Call"},"content":{"rendered":"

Imagine<\/a> receiving a video call from an unknown number. You answer, and within seconds, your Android<\/a> phone is no longer yours. Attackers have silently hijacked the device, gaining complete control through a chain of vulnerabilities buried deep in the modem chipset. This is not a theoretical exploit from a cybersecurity thriller. It is a real and present danger, uncovered by researchers who demonstrated that two specific bugs in the Unisoc modem can be combined to deliver a malicious payload and take over<\/a> an Android smartphone simply by getting the victim to pick up a video call.<\/p>\n

The Unisoc modem bug represents a significant escalation in the threat landscape for mobile security. While modem-level exploits have historically been the domain of advanced state-sponsored attackers, the details emerging from this research suggest a more accessible attack vector. By chaining two vulnerabilities together, the researchers achieved remote code execution on the modem, then leveraged that foothold to compromise the entire Android operating system. The only user action required is answering a phone call\u2014specifically, a video call.<\/p>\n

For users of budget-friendly smartphones that dominate markets in Asia, Africa, Latin America, and parts of Europe, this is not a niche concern. Unisoc (formerly Spreadtrum) is one of the world’s largest suppliers of mobile chipsets, powering hundreds of millions of low-cost and mid-range Android devices from brands such as Realme, Nokia, Honor, BLU, and many original equipment manufacturers (OEMs). The implications are global in scale, yet the attack surface is as personal as a ringing phone.<\/p>\n

How the Attack Works: Two Vulnerabilities, One Fatal Chain<\/h2>\n

The research, conducted by a team of security specialists, focused on the Unisoc modem firmware\u2014the low-level software that handles cellular communications, including voice calls, SMS, and mobile data. Modems operate as separate processors within a smartphone, running their own real-time operating systems with direct access to the radio hardware. Because of this separation, modem exploits can bypass many of the security protections enforced by Android itself.<\/p>\n

The first vulnerability identified involves a buffer overflow condition triggered by a malformed Session Initiation Protocol (SIP) message. SIP is the signaling protocol used to establish, manage, and terminate real-time communication sessions, including voice over LTE (VoLTE) and video calls. By crafting a specific SIP header or payload, an attacker can cause the modem’s SIP stack to write data beyond the allocated buffer, corrupting adjacent memory. This type of flaw is classic and well understood, but its presence in a widely deployed modem firmware is alarming.<\/p>\n

The second vulnerability is a privilege escalation bug within the modem’s file system handling. Once the attacker achieves code execution on the modem via the buffer overflow, they can exploit this second flaw to break out of restricted execution environments and gain full control over the modem’s internal resources. From there, the modem can be used as a launchpad to attack the application processor\u2014the main CPU running Android.<\/p>\n

The attack chain begins with the victim receiving a video call. The attacker’s device sends a specially crafted SIP INVITE request that triggers the buffer overflow. If the victim answers the call, the modem processes the malicious data, executing the payload. The payload then uses the second vulnerability to escalate privileges, ultimately allowing the attacker to write arbitrary data to the modem’s memory and communicate with the Android kernel through shared interfaces. In the demonstrated scenario, the researchers achieved full device takeover, including access to contacts, messages, camera, microphone, and installed applications.<\/p>\n

What Is the Unisoc Modem Bug? A Direct Answer for Readers<\/h2>\n

What is the Unisoc modem bug?<\/strong> The Unisoc modem bug refers to a pair of vulnerabilities\u2014a buffer overflow in the SIP call handling module and a privilege escalation flaw in the modem’s file system\u2014that together allow an attacker to remotely execute code on the modem of a targeted Android device. By sending a maliciously crafted video call request and having the victim answer it, the attacker can hijack the entire phone, gaining full control over sensitive data and hardware functions. The bugs affect Unisoc\u2019s modem firmware, which is present in hundreds of millions of low-cost and mid-range Android smartphones sold worldwide.<\/p>\n

This snippet directly addresses the core question a typical English-speaking reader would have when encountering the headline. It provides a concise, accurate summary that search engines can surface as a featured snippet, while also serving as a rapid primer for the audience.<\/p>\n

Unisoc’s Role in the Android Ecosystem: Why This Matters<\/h2>\n

Unisoc is not a household name like Qualcomm or MediaTek, but its chipsets are ubiquitous in the segments of the smartphone market where price sensitivity is highest. The company holds a commanding share of the entry-level and low-end Android space, particularly in India, Africa, Latin America, and parts of Southeast Asia. Many devices priced under $100 are powered by Unisoc SoCs, and even some models in the $150\u2013$200 range use these processors to keep costs down.<\/p>\n

The modem in question is part of the Unisoc\u2019s cellular baseband IP, integrated into chips ranging from the SC9820 series (used in feature phones and low-end smart feature phones) to more advanced platforms like the T606, T610, and T618 that power tens of millions of Android phones worldwide. Because modem firmware is typically closed-source and vendor-specific, the discovery of a publicly exploitable flaw in such a widely deployed component is a supply-chain security event of the first order.<\/p>\n

Google\u2019s Android security model relies on a layered defense, with the application processor sandboxed from the modem. However, the interface between the modem and the main CPU\u2014often via shared memory or kernel-level drivers\u2014has historically been a weak point. Modem vulnerabilities can bypass Android\u2019s permission system because the modem operates at a lower level than the Android runtime. Even devices running the latest version of Android with all monthly security patches applied remain vulnerable if the modem firmware itself is unpatched.<\/p>\n

Technical Deep Dive: How a Video Call Becomes a Weapon<\/h2>\n

To understand why a video call is the chosen delivery mechanism, one must examine the SIP protocol\u2019s role in modern mobile communication. When a video call is placed over an LTE or 5G network, the call setup uses SIP signaling transmitted over the IP Multimedia Subsystem (IMS). The SIP INVITE message carries a description of the media session, often encoded using the Session Description Protocol (SDP). Both the SIP headers and the SDP body are parsed by the modem\u2019s firmware.<\/p>\n

In the discovered buffer overflow, the modem\u2019s SIP parser fails to validate the length of a particular field\u2014likely a URI parameter or a custom header extension. An attacker can embed shellcode or a ROP (Return-Oriented Programming) chain within the oversized data. When the modem processes the SIP message, the overflow overwrites the return address on the stack or a function pointer in the heap, redirecting execution to the attacker\u2019s code.<\/p>\n

Because the modem runs its own real-time operating system (often ThreadX or a Unisoc-proprietary RTOS), the exploit must be tailored to that environment. The second vulnerability then comes into play: a flaw in how the modem\u2019s file system layer handles access control. By leveraging the initial code execution, the attacker can call internal modem functions that normally require higher privilege levels, ultimately gaining the ability to write directly to shared memory regions that the application processor can read.<\/p>\n

From there, the attacker can inject a kernel module or overwrite a trusted driver to bridge the modem-to-application processor gap. Once the Android kernel is compromised, all user-level protections fall. The attacker can install a backdoor, exfiltrate data, activate the microphone, or even persist the compromise across reboots by modifying modem firmware itself.<\/p>\n

Which Android Devices Are at Risk?<\/h2>\n

Because the vulnerabilities reside in the modem firmware rather than a specific Android OS version, the affected device list is vast and not confined to older software. Any smartphone using a Unisoc chipset with a modem that was unpatched at the time of the research is potentially vulnerable. This includes models from:<\/p>\n