# Unisoc Modem Exploit Chain: Android Takeover via Video Call > An exploit chain targeting Unisoc modems allows remote Android device takeover through a malicious video call, requiring victim interaction. - Published: 2026-08-18T00:41:53.000Z - Severity: high - Category: Vulnerabilities - Tags: Android, Mobile Security, Remote Code Execution, Exploit Chain, Unisoc - Author: Runtime Rebel Intel - Primary source: https://www.darkreading.com/mobile-security/video-call-exploit-chains-two-flaws-unisoc-modems - Canonical: https://runtimerebel.com/blog/unisoc-modem-exploit-chain-android-takeover-via-video-call ## Key points - Android devices with Unisoc modems are vulnerable to remote takeover via a malicious video call requiring user interaction. - Unisoc-powered Android smartphones, including those from major vendors, are susceptible to this multi-stage exploit. - Defenders must ensure all Android devices are updated with the latest security patches released by their device manufacturers. An [exploit](/glossary#exploit) chain targeting vulnerabilities in Unisoc modems can enable a complete takeover of affected Android devices. Discovered by Check Point Research, this method involves an attacker delivering a malicious [payload](/glossary#payload) during a video call, which, if answered by the victim, can lead to remote code execution ([RCE](/glossary#rce)) and full device compromise. This sophisticated attack highlights the critical need for vigilance in mobile security, especially concerning baseband processor vulnerabilities. ## Understanding the Unisoc Modem [Exploit Chain](/glossary#exploit-chain) Check Point Research identified two distinct vulnerabilities within Unisoc modems that, when chained together, form a potent [attack vector](/glossary#attack-vector). Unisoc modems are widely deployed, powering over 10% of smartphones globally, including models from manufacturers like Samsung, Motorola, OnePlus, ZTE, and Realme. This broad reach underscores the potential impact of such a discovery, making it a significant concern for mobile device security. The exploit mechanism leverages flaws in how the modem processes incoming video call data. ### How the Exploit Chain Works The attack unfolds through a specific sequence of actions: * **Initiation via Video Call:** An attacker initiates a video call to a target Android device equipped with a Unisoc modem. * **Victim Interaction Required:** Crucially, for the exploit to succeed, the victim must answer the incoming video call. This user interaction serves as a primary precondition for successful exploitation. * **Payload Delivery:** Once the call is established, the attacker delivers a meticulously crafted, malformed frame through the video call. This frame exploits the first [vulnerability](/glossary#vulnerability) in the modem's processing logic. * **Remote Code Execution:** The successful exploitation of the initial flaw, combined with a second vulnerability, grants the attacker remote code execution capabilities. This RCE allows for a full device takeover, giving the attacker control over the compromised Android smartphone. While Check Point Research did not specify the exact CVEs associated with their discovery, Google released related patches as part of its August 2022 Android Security Bulletin. These patches addressed vulnerabilities, including [CVE-2022-20210](https://nvd.nist.gov/vuln/detail/CVE-2022-20210) and [CVE-2022-20211](https://nvd.nist.gov/vuln/detail/CVE-2022-20211), which are described as remote code execution possibilities in Unisoc modems due to improper input validation. However, the NVD entries for these specific CVEs state that user interaction is not needed for exploitation, which differs from the user interaction requirement (answering the phone) for the exploit chain detailed by Check Point Research, as reported by [Dark Reading](https://www.darkreading.com/mobile-security/video-call-exploit-chains-two-flaws-unisoc-modems). ### Affected Unisoc Modems and Android Devices The vulnerabilities impact various Unisoc modem series. Given Unisoc's market share, a wide array of Android devices across different price points and vendors were potentially affected before patching. Identifying specific affected models often requires consulting vendor advisories, as modem versions can vary even within product lines. Security professionals should be aware that any Android device relying on an unpatched Unisoc modem remains at risk. ## Mitigation and Recommendations for Unisoc Modem Vulnerabilities Mitigating the risk associated with this **Unisoc modem exploit chain** requires prompt action and adherence to established security practices. While the exploit requires user interaction, the severe impact of a full device takeover necessitates immediate attention from both users and enterprise security teams managing mobile fleets. ### Patching and Device Updates * **Apply Vendor Patches:** The most critical step is to ensure that all Android devices are updated to the latest available security patches from their respective manufacturers. Unisoc has released fixes for these vulnerabilities, and device vendors have integrated them into their [firmware](/glossary#firmware) updates. For devices that have not received the August 2022 Android Security Bulletin or later, it is imperative to apply updates as soon as they become available. * **Automated Updates:** Enable automatic updates on all mobile devices to ensure that security patches are applied promptly upon release, reducing the window of vulnerability. ### General Mobile Security Best Practices * **Exercise Caution with Incoming Calls:** Users should be wary of video calls from unknown or suspicious numbers. While answering a call from a known contact is generally safe, unexpected video calls, especially from unrecognised sources, should be handled with caution. * **Regular Software Audits:** For organisations, regularly auditing mobile device software versions and [patch](/glossary#patch) levels is crucial for comprehensive **Unisoc modem vulnerability mitigation**. Implement mobile device management (MDM) solutions to enforce update policies and gain visibility into device security posture. * **[Security Awareness Training](/glossary#security-awareness-training):** Educate users about the risks of answering calls from unknown sources and the importance of keeping their device software up-to-date. Reinforce the understanding that even a seemingly innocuous action like answering a video call can trigger a sophisticated exploit. This Unisoc modem exploit chain serves as a stark reminder that vulnerabilities can exist deep within device hardware components. Proactive patching and user awareness are fundamental pillars in defending against such complex mobile threats. **Related:** [RedWing MaaS: Android Bank Fraud via Telegram Rental Service Analysis](/blog/redwing-maas-android-bank-fraud-via-telegram-rental-service-analysis), [Fake Bahrain Alert Apps Deploy Android Surveillance Malware](/blog/fake-bahrain-alert-apps-deploy-android-surveillance-malware) --- AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/unisoc-modem-exploit-chain-android-takeover-via-video-call