VoLTE Video Call Vulnerability Grants Kernel Access on Unisoc Android Chips
Researchers from SSD Secure Disclosure have published a two-stage attack chain that allows an attacker to obtain access to the Android kernel through the modem firmware of Unisoc chipsets.
The attack starts with a remote code execution vulnerability in the modem that was discovered in March 2026. A specially crafted VoLTE video call can execute arbitrary code on the modem. A subsequent privilege-escalation flaw then reconfigures memory protection and reaches the memory regions used by the Android kernel.
The root cause is the absence of hardware isolation between the modem and application processor in Unisoc system-on-chips. Because the two processors share the same physical memory, code already running in the modem context can modify memory protections and access kernel areas.
The researchers confirmed successful execution of their payload by observing messages in the system log. The vulnerable firmware is used in at least three chipset families: T606, T612 and T7250. These chips are found in devices including the Motorola E13, Realme C33 and Xiaomi Redmi A5.
Exploitation requires control of a private 4G network and VoLTE infrastructure; the victim must also answer the incoming video call. The scenario is therefore not considered mass-exploitable from the public mobile network.
No fix has been released by Unisoc, and no CVE identifier has been assigned. The August Android security bulletin does not address the problem. SSD Secure Disclosure stated that multiple contact attempts via email and LinkedIn received no response from the chip vendor.
Related articles
SAP Commerce Cloud CVE-2026-58231 Critical Flaw Exploited in the Wild Just Three Days After Patch
SAP Commerce Cloud has been hit by a maximum-severity vulnerability tracked as CVE-2026-58231 that carries a CVSS score of 10.0. The flaw resides in the Data Hub Adapter component and allows unauthenticated remote code execution via a single crafted HTTP request. SAP released the official patch on 11 August, yet honeypots recorded the first exploitation attempts only three days later on 14 August. More than 4,200 internet-facing SAP Commerce Cloud instances have been identified worldwide, primarily in Europe and North America. Researchers note that AI-assisted patch analysis enabled attackers to weaponize the fix at unprecedented speed. Organizations are urged to apply the updates to versions 2211.55 or 2211-jdk21.17 immediately and restrict access to the affected endpoints in the meantime.
WordPress Login Page Exposed to Critical XSS2Shell Flaw CVE-2026-64638: Over 11,000 Sites Attacked Across 67 Countries
WordPress core login page vulnerability CVE-2026-64638 enables unauthenticated attackers to trigger reflected XSS that can escalate to full server compromise. The flaw stems from mismatched HTML sanitization between two filtering layers on the wp-login.php page, allowing malicious payloads to execute in the site origin. Imperva observed automated campaigns hitting more than 11,000 sites with hundreds of thousands of requests, predominantly affecting U.S. targets in gaming, education, and finance sectors. Successful exploitation chains the XSS into WordPress REST API and application password creation when an administrator is logged in, ultimately allowing malicious plugin uploads. Official patches are available in WordPress 7.0.3 and backported releases down to 4.7; administrators are urged to verify versions, audit user accounts, and inspect plugin directories immediately.
WireGuard Kernel Module Silently Overwrites AllowedIPs in Trie, Breaking Peer Routing Without Errors
The WireGuard kernel module stores AllowedIPs in a single prefix trie per device rather than per peer, causing exact-match insertions of identical CIDR prefixes to reassign nodes and remove them from the previous peer's list. This behavior silently drops routing for affected peers while handshakes and inbound traffic continue, leading to one-way connectivity failures and frame errors. The issue affects road-warrior setups using 0.0.0.0/0, mesh networks, Kubernetes CNI plugins such as Cilium and Calico, and network operating systems including VyOS and OPNsense. No warning is emitted by wg, wg-quick, or the kernel on overwrite, and the longest-prefix-match lookup ensures only equal-length prefixes collide. The root cause resides in allowedips.c where rcu_assign_pointer redirects the trie node and list_move_tail detaches it from the original peer. The same logic appears across Linux, wireguard-go, wireguard-nt, FreeBSD, and OpenBSD implementations.
RCQ Messenger Duress PIN Flaw Gave Full Access to Real Database on Android
RCQ developers discovered that their duress PIN feature on Android used the same dataKey for both real and decoy accounts, allowing anyone entering the panic code to unlock the entire message history. The original design aimed to present a believable second account but resulted in the decoy PIN acting as a master key rather than a protective boundary. On iOS the implementation was cryptographically separate yet suffered from contact wiping that made the decoy mode look suspiciously empty. After review the team switched both platforms to independent random keys, generated realistic conversation histories, and disabled network features in decoy mode to avoid server-side linkage. Legacy slots created before the fix remain marked as such and require users to set a new decoy PIN. The post-mortem also covers desktop Argon2id vault encryption, notification leakage risks, and why short PINs remain vulnerable to offline brute-force even with strong KDF parameters.