UNISOC Modem EUVD-2026-97142

Exploitation requires the attacker to transmit a crafted SIB1 (System Information Block Type 1) message with malformed scheduling information over the air, which in practice means operating a rogue cellular base station within radio range and getting the target device to select/camp on that cell during idle cell (re)selection. No authentication, credentials, or user interaction are needed once the device processes the broadcast (consistent with PR:N/UI:N), and the modem processes SIB1 automatically. Limiting factors: the attacker must be in radio proximity with suitable SDR/base-station equipment, must out-compete legitimate cells so the victim camps on the rogue cell, and only devices using the affected UNISOC modem/OTA stack are vulnerable - so this is proximity-gated and targeted rather than remotely scalable.

The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 CRITICAL) describes a maximally severe, unauthenticated, no-interaction remote code execution flaw in the UNISOC modem baseband (CWE-121 stack-based buffer overflow). However, these signals must be read against the actual attack surface: the vulnerable input is scheduling information in SIB1 (System Information Block Type 1), which is broadcast by a cell during initial network/cell selection. Realistic exploitation therefore requires the attacker to operate a rogue base station (fake eNodeB/gNodeB) within radio range and induce the target device to camp onto it - this is adjacent/radio-proximity, not arbitrary Internet-routable 'Network' access, so the raw 9.8 overstates remote mass-exploitability. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or widespread automation; this reads as a high-impact but proximity-gated, likely targeted risk rather than a wormable Internet threat. CONFLICTING SIGNAL TO VERIFY: CVSS marks AV:N, but a SIB1/OTA baseband vector implies attacker radio proximity (adjacent) - confirm intended attack vector with UNISOC's bulletin. Net: genuinely dangerous for targeted scenarios (surveillance, border/transit interception), but not a drop-everything mass-exploitation event absent exploit-availability evidence.

An attacker sets up a rogue LTE/5G base station near the target and broadcasts a malicious SIB1 message containing malformed scheduling information; when a vulnerable UNISOC-based device performs cell selection and parses the SIB1, the stack-based overflow triggers, yielding remote code execution within the baseband or a modem crash (denial of service) with no user interaction or authentication. No public exploit code is identified in the provided data, so a working chain would require independent baseband reverse-engineering and a software-defined-radio setup.