Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2
Attackers exploiting Realtek Jungle SDK flaws are deploying the Cling botnet, which hides C2 in STUN traffic.
74
Vulnerability3 · 1 read
CVE-2024-3721
- CVSS 3.1
- 6.3 medium
- EPSS
- 86%p100
- Published
- ·
- Modified
Description · NVD
A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability.
- Weakness
- CWE-78
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
In the news
20 storiesCling Botnet Spoofs Google STUN Traffic to Hide Commands Sent to Infected IoT Devices
Cling IoT botnet hides operator commands in spoofed Google STUN replies while exploiting exposed routers and DVRs.
71
Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices
Cling botnet malware disguises its commands as Google STUN traffic on compromised IoT devices.
68
April 2026 CVE Landscape
60
Mirai Variant Nexcorium Exploits CVE-2024
60
60
60
60
60
60
Experts Reports Sharp Increase in Automated Botnet Attacks Targeting PHP Servers and IoT Devices
60
60
60
60
60
50
47
47
35
35