Vulnerabilities OhrTech has fixed on its devices, with dates.https://ohrtech.net/en-ushttps://ohrtech.net/security/unisoc-modem-cve-2025-31718/https://ohrtech.net/security/unisoc-modem-cve-2025-31718/[High · Fixed] A flaw in how Unisoc's modem firmware validates network input can be triggered remotely, with no user interaction. Unisoc lists the T606 as affected. OhrTech devices now ship modem firmware that includes the fix.Sat, 17 Oct 2026 12:00:00 GMT<h2>What the vulnerability is</h2><p>Unisoc reports a flaw in how its modem firmware validates input from the network. It can be triggered remotely, with no user interaction and no privileges, and Unisoc describes the impact as a possible system crash that &quot;could lead to remote escalation of privilege&quot;. Unisoc rates it 7.5 (High) and lists the T606, T612 and T616 among the affected chips.</p><h2>What we did</h2><p>Modem firmware is a closed Unisoc binary, so this can only be fixed by shipping newer firmware. The Foundation OS ships modem firmware from a build at security patch level 2026-09-01, which covers CVE-2025-31718: Google lists the fix in the <a href="https://source.android.com/docs/security/bulletin/2025-12-01">December 2025 Android Security Bulletin</a> at patch level 2025-12-05.</p><h2>Who needs to act</h2><p>Nobody. The fix is part of the Foundation OS that every OhrTech device runs.</p><h2>Credit</h2><p>Unisoc disclosed this flaw in its October 2025 security bulletin and did not name who found it.</p>HighFixedCVE-2025-31718https://ohrtech.net/security/unisoc-tee-service-cve-2022-48373-48374/https://ohrtech.net/security/unisoc-tee-service-cve-2022-48373-48374/[Medium · Not affected] Two out-of-bounds writes in Unisoc's tee service can crash it. Unisoc lists the T606 as affected. OhrTech devices were never vulnerable: we replaced Unisoc's TEE and its services with Trusty.Sat, 17 Oct 2026 12:00:00 GMT<h2>What the vulnerability is</h2><p>Unisoc&#39;s &quot;tee service&quot; is missing a bounds check in two places, allowing out-of-bounds writes. Unisoc describes the impact as local denial of service, with System execution privileges needed; CISA rates them 4.4 (Medium). Its affected list includes the T606, T612 and T616, and it fixed both in its May 2023 security bulletin.</p><h2>Why OhrTech devices were never vulnerable</h2><p>The Trusted Execution Environment (TEE) is the isolated, secure-world operating system that holds keys and runs trusted code apart from Android. On these chips, Unisoc ships its own modified version of Google&#39;s Trusty, with its own trusted apps and the Android services that talk to them.</p><p>The Foundation OS does not use any of it. We replaced Unisoc&#39;s TEE and its services with the reference Trusty from the Android Open Source Project, so the affected Unisoc code has never been part of the software on an OhrTech device.</p><h2>Who needs to act</h2><p>Nobody.</p><h2>Credit</h2><p>Unisoc disclosed both flaws in its May 2023 security bulletin and did not name who found them.</p>MediumNot affectedCVE-2022-48373CVE-2022-48374https://ohrtech.net/security/unisoc-trusty-service-cve-2024-39427-39428/https://ohrtech.net/security/unisoc-trusty-service-cve-2024-39427-39428/[Medium · Not affected] Two out-of-bounds writes in Unisoc's trusty service can crash it. Unisoc lists the T606 as affected. OhrTech devices were never vulnerable: we replaced Unisoc's TEE and its services with Trusty.Sat, 17 Oct 2026 12:00:00 GMT<h2>What the vulnerability is</h2><p>Unisoc&#39;s &quot;trusty service&quot; is missing a bounds check in two places, allowing out-of-bounds writes. Unisoc describes the impact as local denial of service, with System execution privileges needed, and rates them 5.1 and 6.8 (Medium). Its affected list includes the T606, T612 and T616, and it fixed both in its July 2024 security bulletin.</p><h2>Why OhrTech devices were never vulnerable</h2><p>The Trusted Execution Environment (TEE) is the isolated, secure-world operating system that holds keys and runs trusted code apart from Android. On these chips, Unisoc ships its own modified version of Google&#39;s Trusty, with its own trusted apps and the Android services that talk to them.</p><p>The Foundation OS does not use any of it. We replaced Unisoc&#39;s TEE and its services with the reference Trusty from the Android Open Source Project, so the affected Unisoc code has never been part of the software on an OhrTech device.</p><h2>Who needs to act</h2><p>Nobody.</p><h2>Credit</h2><p>Unisoc disclosed both flaws in its July 2024 security bulletin and did not name who found them.</p>MediumNot affectedCVE-2024-39427CVE-2024-39428https://ohrtech.net/security/unisoc-tee-drm-trustlet-cve-2023-33913/https://ohrtech.net/security/unisoc-tee-drm-trustlet-cve-2023-33913/[High · Not affected] A stack buffer overflow in the DRM trustlet of Unisoc's TrustZone software allows code execution inside the TEE. Unisoc lists the T606 as affected. OhrTech devices were never vulnerable: they do not run Unisoc's TEE.Sat, 17 Oct 2026 12:00:00 GMT<h2>What the vulnerability is</h2><p>Unisoc&#39;s TEE includes a trusted app for cryptography used by DRM: a Widevine interface plus Unisoc&#39;s own OEMCrypto API. Laszlo Szapula of TASZK Security Labs found that one of its commands copies a sender-supplied number of bytes onto a fixed-size stack buffer without checking the size, and the trustlet has no stack protection. A program able to talk to the trustlet can overflow the buffer and run code inside the TEE. <a href="https://labs.taszk.io/blog/post/92_unisoc_trustlet_bof/">Read TASZK&#39;s advisory</a>.</p><p>Unisoc lists the T606, T612, T616, T610, T618, T760, T770, T820 and S8000 as affected, and fixed it in its August 2023 security bulletin. NVD rates it 7.2 (High).</p><h2>Why OhrTech devices were never vulnerable</h2><p>The Trusted Execution Environment (TEE) is the isolated, secure-world operating system that holds keys and runs trusted code apart from Android. On these chips, Unisoc ships its own modified version of Google&#39;s Trusty, with its own trusted apps and the Android services that talk to them.</p><p>The Foundation OS does not use any of it. We replaced Unisoc&#39;s TEE and its services with the reference Trusty from the Android Open Source Project, so the affected Unisoc code has never been part of the software on an OhrTech device.</p><h2>Who needs to act</h2><p>Nobody.</p><h2>Credit</h2><p>Found by Laszlo Szapula of <a href="https://labs.taszk.io/">TASZK Security Labs</a>, who reported it to Unisoc in May 2022 and published a detailed advisory. Thank you.</p>HighNot affectedCVE-2023-33913https://ohrtech.net/security/unisoc-volte-remote-code-execution/https://ohrtech.net/security/unisoc-volte-remote-code-execution/[Critical · Fixed] Two published flaws in Unisoc modem firmware let a video call run code on the modem and then take over the Android kernel. Unisoc has not responded and there is no vendor fix. We patched the modem ourselves, made sure it cannot change the kernel's code, and hardened the interface between them.Sat, 17 Oct 2026 12:00:00 GMT<h2>What the vulnerability is</h2><p>Independent security researcher 0x50594d, working with SSD Secure Disclosure, found and published two flaws in the modem firmware shared by several Unisoc chips: the T606, T612, T616 and T7250. These chips are used in budget phones from Motorola, Xiaomi and Realme. The OhrTech Aleph uses the T606.</p><p><strong>Stage one: code on the modem, from a video call.</strong> The modem mishandles the session description carried in the signalling that sets up a video call. A specially crafted call corrupts the modem&#39;s memory and can run the attacker&#39;s code on it. <a href="https://ssd-disclosure.com/unisoc-t612-rce/">Read the researcher&#39;s write-up of the modem flaw</a>.</p><p><strong>Stage two: from the modem to the Android kernel.</strong> Code running on the modem can switch off the modem&#39;s own memory protection, then read and write all of the device&#39;s physical memory, including the Android kernel&#39;s code. <a href="https://ssd-disclosure.com/unisoc-t612-lpe/">Read the researcher&#39;s write-up of the kernel escalation</a>.</p><p>Together, the two give an attacker full control of the phone from a single video call. The researchers demonstrated the chain on their own test cellular network, against a Motorola E13, a Xiaomi Redmi A5 and a Realme C33.</p><h2>What the chip maker did</h2><p>Nothing. SSD reports that it tried to reach Unisoc through several channels before each publication and received no response. No CVE has been assigned, and Unisoc has not fixed the flaw, even in its newest modem firmware.</p><p>This is typical of the market rather than rare: more than 40% of Android devices in the world no longer receive security updates at all.</p><h2>What we did</h2><p><strong>We patched the modem ourselves.</strong> With no fix coming from Unisoc, we corrected the flaw in the modem firmware directly. The patched modem ships on every OhrTech device.</p><p><strong>The modem cannot change the kernel&#39;s code.</strong> Stage two works by writing into the kernel. A hardware memory monitor now guards the kernel&#39;s code and read-only data: any write to them from the modem, or from any other peripheral, halts the device the moment it happens. On restart, the kernel is loaded again from the signed, verified image.</p><p><strong>We hardened the interface between the modem and the kernel.</strong> The kernel talks to the modem and the device&#39;s other processors through shared memory. We audited that channel, now treat those processors as untrusted, and fixed 13 places where values the modem controls could steer the kernel&#39;s memory accesses, copy lengths or array indices. A compromised modem can no longer use the channel to read or write arbitrary kernel memory.</p><h2>Who needs to act</h2><p>Nobody. All three changes are part of the Foundation OS that every OhrTech device runs.</p><p>Engineers who want more technical detail can ask us directly through the <a href="/contact/#engineering">engineering contact</a>.</p><h2>Credit</h2><p>Both flaws were found by 0x50594d and published by <a href="https://ssd-disclosure.com/">SSD Secure Disclosure</a>. Thank you for the careful research and the public write-ups. Weakness classes: CWE-674 (uncontrolled recursion) and CWE-1189 (improper isolation of shared resources on a system-on-chip).</p>CriticalFixed