Multiple Flaws Affecting Realtek Wi-Fi SDKs Impact Nearly a Million IoT Devices

Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or mini_upnpd and is the successor to miniigd. The server is vulnerable to a stack buffer overflow vulnerability that is present due to unsafe parsing of the UPnP SUBSCRIBE/UNSUBSCRIBE Callback header. Successful exploitation of this vulnerability allows remote unauthenticated attackers to gain arbitrary code execution on the affected device.

Realtek's Jungle SDK, a software development kit used to build firmware for a wide range of consumer and small-office networking devices (most notably routers), contains multiple memory corruption vulnerabilities that can be triggered remotely over the network; public disclosure tied the flaws to unauthenticated network-facing components bundled with the SDK, such as its UPnP and DHCP handling. An attacker who sends crafted packets to a vulnerable device can corrupt memory and, per the associated weakness types (CWE-78 command injection, CWE-138 improper neutralization), end up executing arbitrary code or operating-system commands with the privileges of the vulnerable service, effectively taking over the device. Because the SDK is licensed into many vendors' products rather than sold as a standalone application, exposure spans numerous router and embedded-device vendors, and end users may not even know their device relies on it. Exact affected SDK version ranges and per-vendor firmware lists were not specified in the available data, so defenders should rely on the latest vendor advisories. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2021-12-10, indicating confirmed exploitation in the wild; ransomware use is unknown and no public proof-of-concept is flagged in the available data.

Do: Per CISA's required action, apply firmware updates per your device vendor's instructions, since patches are distributed by the vendors that build on the SDK rather than by Realtek directly. Identify whether your router or embedded device uses Realtek Jungle SDK-based firmware (check the vendor's model/advisory pages) and prioritize updating internet-facing devices. Where patched firmware is not yet available, restrict direct internet exposure (firewall the WAN side) and disable or limit UPnP/DHCP-related exposed services if the vendor supports doing so, while monitoring vendor advisories.

The Realtek Jungle SDK (v2.x up to v3.4.14B) ships an HTTP management web server, in both Go-Ahead ('webs') and Boa ('boa') variants, containing multiple stack buffer overflows in form handlers such as formRebootCheck, formWsc, formWlanMultipleAP, formWlSiteSurvey and formStaticDHCP, plus arbitrary command execution/injection flaws in formSysCmd and formWsc. An unauthenticated attacker triggers these by sending crafted HTTP requests with oversized submit-url, ifname, hostname or peerPin parameters, or by injecting commands via the sysCmd or peerPin parameters. Successful exploitation yields arbitrary code execution on the device, typically giving the attacker full control of the affected router, access point or IoT device. Any device whose vendor embedded the affected SDK is exposed, with public reporting linking the flaws to roughly 65 downstream vendors and nearly a million internet-visible devices. Exploitation is confirmed in the wild: the issue is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), and researchers observed Mirai botnet variants and other attackers compromising Realtek-based devices; ransomware use is unknown.

Do: Apply firmware updates from your device vendor incorporating a patched Realtek SDK (newer than v3.4.14B), per CISA's required action; since vendors ship modified builds, confirm with the manufacturer that your model is fixed. Until patched, disable remote/web-based administration or restrict the management interface (WAN-facing HTTP) with a firewall so it is not internet-exposed. Defenders should also monitor Realtek-based devices for botnet-style activity (e.g., Mirai-variant traffic), as a public PoC/advisory from IoT Inspector is available and exploitation is ongoing.