CVE-2021-35394

CVE-2021-35394 is a critical-severity (CVSS 9.8) vulnerability in Realtek Jungle Software Development Kit (SDK). CISA added it to the Known Exploited Vulnerabilities catalog on December 10, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by December 24, 2021. CISA does not currently list it as used in ransomware campaigns. Realtek has 3 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain
• https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en
• https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf
• https://www.securityfocus.com/archive/1/534765
• https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain
• https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en
• https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf
• https://www.securityfocus.com/archive/1/534765