CRITICAL🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2021-35394

CVSS 9.8v3.1pub. 2021-08-16upd. 2025-11-07

Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Realtek Rtl819x Jungle Software Development Kit

    APP
    Realtek
    2.0 – 3.4.14b

CISA KEV — detailsi

Vendori
Realtek
Producti
Jungle Software Development Kit (SDK)
Added to KEVi
December 10, 2021
Remediation deadline (US Federal)i
December 24, 2021(overdue)
Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 24 grudnia 2021
Tags
Auth BypassCommand Injection
CWE
References

Related vulnerabilities

CVE-2021-35395CRITICAL9.8⚠ KEVPL ✓same product

Wielokrotny stack buffer overflow i command injection w Realtek Jungle SDK

CVE-2021-35393CRITICAL9.8PL ✓same product

Stack buffer overflow w Realtek Jungle SDK — RCE przez UPnP SUBSCRIBE

CVE-2023-34435HIGH7.2same product

A firmware update vulnerability exists in the boa formUpload functionality of Realtek rtl819x Jungle SDK v3.4....

CVE-2023-41251HIGH7.2same product

A stack-based buffer overflow vulnerability exists in the boa formRoute functionality of Realtek rtl819x Jungl...

CVE-2023-45215HIGH7.2same product

A stack-based buffer overflow vulnerability exists in the boa setRepeaterSsid functionality of Realtek rtl819x...