NetSight
IP …
critical9.8Known exploitedPublic exploit code

CVE-2014-8361

Realtek SDK Improper Input Validation Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-09-18. Federal due date: 2023-10-09.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.

Affected products

VendorProductAffected versions
DlinkDir-905l Firmware
through 2.05b01
DlinkDir-605l Firmware
through 1.14b06
through 2.07b02
through 3.03b07
DlinkDir-600l Firmware
through 1.15
through 2.056b06
DlinkDir-619l Firmware
through 1.15
through 2.07b02
DlinkDir-809 Firmware
through 1.04b02
DlinkDir-900l Firmware
before 1.15b01
RealtekRealtek Sdk
All versions
DlinkDir-501 Firmware
through 1.01b04
DlinkDir-515 Firmware
through 1.01b04
DlinkDir-615 Firmware
through 6.06b03
Version 10.01b02
AtermWg1900hp2 Firmware
through 1.3.1
AtermWg1900hp Firmware
through 2.5.1

References