by Kastro
Paper/Archive/CVE-2021-35394

CVE-2021-35394

Realtek Jungle Software Development Kit (SDK) — Realtek Jungle SDK Remote Code Execution Vulnerability

KEV · due 24 DecEPSS 100%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refsecurityfocus.com/archive/1/534765refrealtek.com/en/cu-1-en/cu-1-taiwan-enrefrealtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdfrefiot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chainrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35394kevcisa.gov/known-exploited-vulnerabilities-catalog