UNISOC modem flaw lets attackers hijack Android phones via video call

A vulnerability in UNISOC modem firmware could allow remote code execution with kernel privileges during video calls, impacting devices like the Xiaomi Redmi A5 and Motorola E13. The flaw arises from improper isolation between modem and kernel memory, classified as Common Weakness Enumeration (CWE) 1189. Exploits can disable protections on a Memory Protection Unit, enabling modem access to Android kernel memory. Despite attempts to contact UNISOC, no vendor updates have been reported yet to remediate the issue. Similar risks have been identified in other cellular modem components.