← CVE Radar
CVE-2021-35394Realtek Jungle SDK Remote Code Execution Vulnerability
Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.
9.8 CRITICALEPSS 99.87%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 10.0 | HIGH | 2.0NVD | AV:N/AC:L/Au:N/C:C/I:C/A:C |
CISA required action
⚡ Known exploited · remediation due Dec 24, 2021
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2021-35394
- Status
- Analyzed
- Assigner (CNA)
- mitre
- Published
- Aug 16, 2021
- Last modified
- 2026-06-17 03:57 UTC
Affected Products
From NVD CPE configurations.
realtekrtl819x jungle software development kit1 version range
- 2.0 through 3.4.14b
References
- iot-inspector.com https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain
- realtek.com https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en
- realtek.com https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf
- securityfocus.com https://www.securityfocus.com/archive/1/534765
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35394