Chained Modem Flaws Enable Remote Device Takeover via Video Call
Researchers uncovered two chained vulnerabilities in Unisoc modems — widely embedded in budget and mid-range Android devices — that together allow a remote attacker to fully compromise a device simply by sending a malicious payload and luring the victim into answering a video call. The root issue lies in insufficient security vetting of third-party modem firmware integrated into the Android supply chain, where OEMs ship components without rigorous independent vulnerability assessment. This is compounded by slow or absent patch distribution pipelines, meaning many end users never receive fixes even after vulnerabilities are publicly disclosed. The exploit requires minimal user interaction (just answering a call), making it especially dangerous for non-technical users who cannot be expected to recognize the threat.
Tactical Insight
Immediate actions
- Apply any available firmware or security patches from your device OEM or carrier as soon as they are released.
- Temporarily restrict or disable video calling features on affected Unisoc-based devices until a patch is confirmed applied.
- Enroll all managed mobile devices in a Mobile Device Management (MDM) platform to enforce rapid patch deployment.
Long-term improvements
- Require OEM and component vendors to provide documented vulnerability disclosure and patching SLAs as part of procurement contracts.
- Maintain a complete hardware and firmware inventory, including modem chipset vendors, for all organizational mobile devices.
- Establish a supply chain security review process that includes third-party firmware and embedded component assessment before device procurement.
Detection measures
- Deploy mobile threat defense (MTD) solutions capable of detecting anomalous modem or baseband activity on managed devices.
- Monitor security advisories from Unisoc, device OEMs, and Android security bulletins via automated threat intelligence feeds.
- Implement network-level anomaly detection to flag unusual signaling or data patterns originating from mobile endpoints.