CVE-2021-35393

Katalog CVE

CVSS 9.8 · Critical EPSS 68,3%

Kerentanan Out-of-bounds Write pada realtek rtl819x jungle software development kit. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or mini_upnpd and is the successor to miniigd. The server is vulnerable to a stack buffer overflow vulnerability that is present due to unsafe parsing of the UPnP SUBSCRIBE/UNSUBSCRIBE Callback header. Successful exploitation of this vulnerability allows remote unauthenticated attackers to gain arbitrary code execution on the affected device.

Rincian

Terbit di NVD

16 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

68,3% peluang dieksploitasi; lebih tinggi dari 99,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en broken link · patch · advisory vendor
• https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf patch · advisory vendor
• https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain broken link · exploit · advisory pihak ketiga