CVE-2021-35394

Realtek Jungle SDK Remote Code Execution Vulnerability

Rtl819X Jungle Software Development Kit

Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.

16. Aug 2021

Ausgewertete Quellen

• Hersteller
  https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en
• Hersteller
  https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf
• Hinweis
  https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain
• Hinweis
  https://www.securityfocus.com/archive/1/534765
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35394
• CISA
  Realtek Jungle SDK Remote Code Execution Vulnerability
• NVD
  CVE-2021-35394