Unisoc
Monthly
A stack-based buffer overflow (CWE-121) in the UNISOC modem OTA stack lets an attacker within radio range achieve remote code execution or crash the baseband by broadcasting a crafted SIB1 message whose scheduling information is not properly validated, which the modem parses automatically with no authentication or user interaction (PR:N/UI:N). The vendor assigned a CVSS 3.1 score of 9.8 with an AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector, but the exploitation path is adjacency-gated: the adversary must operate a rogue cellular base station (SDR plus a full baseband stack), out-compete legitimate cells so the victim device camps on the malicious cell during idle-mode (re)selection, and the target must run the affected UNISOC modem/OTA stack - making this a proximity-limited, targeted attack rather than an internet-scale one. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Information disclosure in UNISOC modem (baseband) firmware allows a local, low-privileged attacker to read sensitive data that is captured in modem crash dumps without filtering of sensitive fields. Exploitation requires the attacker to already have local code execution on an affected device - for example an installed malicious app or a local process with access to the dump - with no remote vector (AV:L, PR:L) and no user interaction (UI:N). Rated CVSS 5.5 with confidentiality-only impact, this is a moderate-severity local exposure rather than an urgent remote-exploitation priority; no public exploit code has been identified at time of analysis, and the specific affected firmware/chipset versions are not specified in the available data.
A stack-based buffer overflow (CWE-121) in the UNISOC modem OTA stack lets an attacker within radio range achieve remote code execution or crash the baseband by broadcasting a crafted SIB1 message whose scheduling information is not properly validated, which the modem parses automatically with no authentication or user interaction (PR:N/UI:N). The vendor assigned a CVSS 3.1 score of 9.8 with an AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector, but the exploitation path is adjacency-gated: the adversary must operate a rogue cellular base station (SDR plus a full baseband stack), out-compete legitimate cells so the victim device camps on the malicious cell during idle-mode (re)selection, and the target must run the affected UNISOC modem/OTA stack - making this a proximity-limited, targeted attack rather than an internet-scale one. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Information disclosure in UNISOC modem (baseband) firmware allows a local, low-privileged attacker to read sensitive data that is captured in modem crash dumps without filtering of sensitive fields. Exploitation requires the attacker to already have local code execution on an affected device - for example an installed malicious app or a local process with access to the dump - with no remote vector (AV:L, PR:L) and no user interaction (UI:N). Rated CVSS 5.5 with confidentiality-only impact, this is a moderate-severity local exposure rather than an urgent remote-exploitation priority; no public exploit code has been identified at time of analysis, and the specific affected firmware/chipset versions are not specified in the available data.