[ CVE-2014-8361 · Published 1 May 2015 ]
Realtek SDK Improper Input Validation Vulnerability
Exploited · CISA KEV CVSS 9.8
EPSS 100%No fix listed yet
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-09-18
- EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)
- Critical severity: CVSS 9.8
[ Description ]Official description
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.
CISA: Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 9 Oct 2023): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- jvn.jp/en/jp/JVN47580234/index.htmlThird Party Advisory
- jvn.jp/en/jp/JVN67456944/index.htmlThird Party Advisory
- packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-Command-Execution.htmlThird Party AdvisoryVDB Entry
- securityadvisories.dlink.com/security/publication.aspxVendor Advisory
- www.securityfocus.com/bid/74330Broken LinkThird Party AdvisoryVDB Entry
- www.zerodayinitiative.com/advisories/ZDI-15-155Third Party AdvisoryVDB Entry
- sensorstechforum.com/hinatabot-cve-2014-8361-ddosThird Party Advisory
- web.archive.org/web/20150909230440/http://securityadvisories.dlink.com/security/publica…Third Party Advisory
- www.exploit-db.com/exploits/37169Third Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource