Unisoc Modem Flaws Enable Android Video Call Hijack

Introduction

In recent security research, a team of analysts uncovered a method that leverages two separate weaknesses in Unisoc cellular modems to compromise an Android smartphone during a video call. By sending a crafted payload and convincing the user to answer the incoming call, the attacker can gain full control of the device. This technique demonstrates how modest bugs in network firmware can be combined to create a serious threat vector.

How the Dual Vulnerabilities Form a Powerful Exploit Chain

The first weakness resides in the modem’s handling of SIP signaling used for video call setup. An improper validation of the caller‑ID field allows an attacker to inject a specially crafted SIP header that triggers a memory‑corruption condition in the baseband software.

The second issue is a flaw in the audio processing thread that fails to adequately check the size of incoming RTP packets. When the corrupted SIP data is processed, the oversized packet overflows a stack buffer, giving the attacker the ability to overwrite return addresses and execute arbitrary code.

When these two issues are triggered in sequence, the malicious SIP packet creates the initial foothold, and the buffer overflow supplies the execution environment needed for a payload. The result is a silent takeover: the device appears to be receiving a normal video call, while in the background the attacker runs code with system privileges.

Technical details show that the exploit does not require any user interaction beyond answering the call, and it works across a range of Android versions that rely on the same Unisoc modem stack. The combination illustrates the danger of interdependent bugs in complex telecom stacks.

Implications for Android Users and Mitigation Steps

The successful exploitation of this chain means that a malicious actor could silently install surveillance tools, exfiltrate data, or manipulate communications without the victim’s knowledge. Because the attack occurs during a video call, the user’s attention is already focused on the screen, making the deception more convincing.

From a defensive perspective, users should keep their device firmware and carrier‑provided modem updates current, as patches often address these low‑level issues. Additionally, employing network‑level firewalls that block suspicious SIP traffic and using apps that verify call authenticity can reduce exposure.

Enterprises can harden their devices by disabling unnecessary modem services, enforcing strict app vetting policies, and monitoring for anomalous call‑setup behavior. Security teams should also consider adding runtime detection rules that flag abnormal RTP packet sizes or unexpected SIP header modifications.

By combining these measures, the attack surface is significantly reduced, and the likelihood of a successful hijack drops dramatically.

Conclusion

The research serves as a stark reminder that the security of modern smartphones rests on many moving parts, from high‑level applications down to the cellular modem firmware. By understanding how these two modest bugs can be combined, developers, carriers, and end‑users can better appreciate the need for comprehensive update cycles, rigorous code audits, and proactive monitoring. As the threat landscape continues to evolve, the ability to spot and neutralize multi‑vector attacks will remain a cornerstone of robust mobile security. Grivyonx Cloud’s automated patch management and continuous threat‑intelligence services help organizations stay ahead of such emerging risks without compromising user experience.