Paper/Archive/CVE-2014-8361

CVE-2014-8361

Realtek SDK — Realtek SDK Improper Input Validation Vulnerability

KEV · due 9 Oct EPSS 100%public exploit SSVC act CVSS 9.8

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 100.01.000 × 2020.0 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refzerodayinitiative.com/advisories/ZDI-15-155 refsecurityadvisories.dlink.com/security/publication.aspx?name=SAP10055 refpacketstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-Command-Execution.html refsecurityfocus.com/bid/74330 exploitexploit-db.com/exploits/37169 writeupjvn.jp/en/jp/JVN47580234/index.html writeupjvn.jp/en/jp/JVN67456944/index.html refsensorstechforum.com/hinatabot-cve-2014-8361-ddos refweb.archive.org/web/20150909230440/http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055 refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-8361 kevcisa.gov/known-exploited-vulnerabilities-catalog