CVE-2021-35394

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 99,9%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada realtek rtl819x jungle software development kit. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 10 Desember 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.

Rincian

Terbit di NVD

16 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

99,9% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Realtek Jungle SDK Remote Code Execution Vulnerability

Masuk KEV

10 Desember 2021

Tenggat CISA

24 Desember 2021 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en broken link · patch · advisory vendor
• https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf patch · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35394 pemerintah AS
• https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain broken link · exploit · advisory pihak ketiga
• https://www.securityfocus.com/archive/1/534765 broken link · advisory pihak ketiga · vdb entry