Realtek Jungle SDK Remote Code Execution Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-12-10
• EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.

CISA: RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 24 Dec 2021): Apply updates per vendor instructions.

• Patch on realtek.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
• Patch on realtek.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chainBroken LinkExploitThird Party Advisory
• www.realtek.com/en/cu-1-en/cu-1-taiwan-enBroken LinkPatchVendor Advisory
• www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdfPatchVendor Advisory
• www.securityfocus.com/archive/1/534765Broken LinkThird Party AdvisoryVDB Entry
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource