critical9.8Known exploited
CVE-2021-35394
Realtek Jungle SDK Remote Code Execution Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-12-10. Federal due date: 2021-12-24.
Apply updates per vendor instructions.
Impact
Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Realtek | Rtl819x Jungle Software Development Kit | from 2.0 through 3.4.14b |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain
- https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en
- https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf
- https://www.securityfocus.com/archive/1/534765
- https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain
- https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en
- https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf
- https://www.securityfocus.com/archive/1/534765
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35394