Realtek SDK flaws exploited to deliver Mirai bot variant
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-20090 | Unauthenticated Path Traversal in Arcadyan Buffalo Router Firmware CVE-2021-20090 is a path traversal flaw (CWE-22) in the web interface of Arcadyan's Buffalo router firmware. By sending crafted HTTP requests containing directory traversal sequences, an unauthenticated, remote attacker can bypass the device's authentication. Successful exploitation grants access to sensitive information and otherwise protected functionality on the router without valid credentials. The flaw affects multiple router models across several different vendors, because Arcadyan's Buffalo firmware is embedded in a range of OEM and ISP-distributed products. Exploitation is confirmed in the wild: the vulnerability was added to CISA's KEV catalog on 2021-11-03, and EPSS rates the probability of exploitation within 30 days at 100% (100th percentile). Do: Apply firmware updates from the router vendor as directed in the CISA KEV required action. Until patched, restrict or disable WAN-side remote management of the device's web interface. Review router configurations for unauthorized changes after patching, since unauthenticated remote access was possible. | 9.8 | 100% | KEV PoC ×2 |
| massplausibly millions of deployed consumer/ISP routers; internet-exposed subset unknown | |
| CVE-2021-35393 +1 in the same advisory: …35392 | Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or mini_upnpd and is the successor to miniigd. The server is vulnerable to a stack buffer overflow vulnerability that is present due to unsafe parsing of the UPnP SUBSCRIBE/UNSUBSCRIBE Callback header. Successful exploitation of this vulnerability allows remote unauthenticated attackers to gain arbitrary code execution on the affected device. NVD description · AI analysis pending | 9.8 group max | 70% | PoC |
| — | |
| CVE-2021-35394 | Remote Code Execution via Memory Corruption in Realtek Jungle SDK Realtek's Jungle SDK, a software development kit used to build firmware for a wide range of consumer and small-office networking devices (most notably routers), contains multiple memory corruption vulnerabilities that can be triggered remotely over the network; public disclosure tied the flaws to unauthenticated network-facing components bundled with the SDK, such as its UPnP and DHCP handling. An attacker who sends crafted packets to a vulnerable device can corrupt memory and, per the associated weakness types (CWE-78 command injection, CWE-138 improper neutralization), end up executing arbitrary code or operating-system commands with the privileges of the vulnerable service, effectively taking over the device. Because the SDK is licensed into many vendors' products rather than sold as a standalone application, exposure spans numerous router and embedded-device vendors, and end users may not even know their device relies on it. Exact affected SDK version ranges and per-vendor firmware lists were not specified in the available data, so defenders should rely on the latest vendor advisories. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2021-12-10, indicating confirmed exploitation in the wild; ransomware use is unknown and no public proof-of-concept is flagged in the available data. Do: Per CISA's required action, apply firmware updates per your device vendor's instructions, since patches are distributed by the vendors that build on the SDK rather than by Realtek directly. Identify whether your router or embedded device uses Realtek Jungle SDK-based firmware (check the vendor's model/advisory pages) and prioritize updating internet-facing devices. Where patched firmware is not yet available, restrict direct internet exposure (firewall the WAN side) and disable or limit UPnP/DHCP-related exposed services if the vendor supports doing so, while monitoring vendor advisories. | 9.8 | 100% | KEV PoC |
| mass≈ millions of devices (SDK embedded in consumer router/IoT firmware across many vendors; at least ~100,000 likely internet-exposed) | |
| CVE-2021-35395 | Multiple Stack Buffer Overflows and Command Injection in Realtek Jungle SDK Web Server The Realtek Jungle SDK (v2.x up to v3.4.14B) ships an HTTP management web server, in both Go-Ahead ('webs') and Boa ('boa') variants, containing multiple stack buffer overflows in form handlers such as formRebootCheck, formWsc, formWlanMultipleAP, formWlSiteSurvey and formStaticDHCP, plus arbitrary command execution/injection flaws in formSysCmd and formWsc. An unauthenticated attacker triggers these by sending crafted HTTP requests with oversized submit-url, ifname, hostname or peerPin parameters, or by injecting commands via the sysCmd or peerPin parameters. Successful exploitation yields arbitrary code execution on the device, typically giving the attacker full control of the affected router, access point or IoT device. Any device whose vendor embedded the affected SDK is exposed, with public reporting linking the flaws to roughly 65 downstream vendors and nearly a million internet-visible devices. Exploitation is confirmed in the wild: the issue is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), and researchers observed Mirai botnet variants and other attackers compromising Realtek-based devices; ransomware use is unknown. Do: Apply firmware updates from your device vendor incorporating a patched Realtek SDK (newer than v3.4.14B), per CISA's required action; since vendors ship modified builds, confirm with the manufacturer that your model is fixed. Until patched, disable remote/web-based administration or restrict the management interface (WAN-facing HTTP) with a firewall so it is not internet-exposed. Defenders should also monitor Realtek-based devices for botnet-style activity (e.g., Mirai-variant traffic), as a public PoC/advisory from IoT Inspector is available and exploitation is ongoing. | 9.8 | 98% | KEV PoC |
| mass≈1,000,000 internet-exposed devices (public scans reported nearly a million Realtek-based devices) |
Full article736 words · extracted from securityaffairs.com · click to collapse
Researchers warn that threat actors are actively exploiting Realtek SDK vulnerabilities since their technical details were publicly disclosed.
Researchers from SAM Seamless Network warn that threat actors are actively exploiting Realtek SDK vulnerabilities since their technical details were publicly disclosed.
Realtek published a security advisory on August 15 to warn customers about security updates to address vulnerabilities in its software developers kits (SDK) which is used by at least 65 separate vendors.
On August 15, firmware security company IoT Inspector published details about the flaws.
SAM Seamless Network observed threat actors exploiting the vulnerabilities since August 18.
“On August 16th, three days ago, multiple vulnerabilities in a software SDK distributed as part of Realtek chipsets were disclosed by IoT Inspector Research Lab [1]. The vulnerabilities allow attackers to fully compromise and take control of affected devices. Just yesterday, only two days after the publication, our home security solution, Secure Home, detected attempts to exploit these vulnerabilities to spread a variant of a Mirai malware.” reported IoT Inspector.
“One of the vulnerabilities disclosed, CVE-2021-35395 [2], affects the web interface that is part of the SDK, and is a collection of 6 different vulnerabilities. As of August 18th, we have identified attempts to exploit CVE-2021-35395 in the wild.”
Experts from IoT Inspector discovered more than a dozen vulnerabilities in the Realtek SDK used by companies that use its RTL8xxx chips. Experts reported that some of the flaws could allow a remote, unauthenticated attacker to take complete control of a vulnerable device.
“Supported by IoT Inspector’s firmware analysis platform, we performed vulnerability research on those binaries and identified more than a dozen vulnerabilities – ranging from command injection to memory corruption affecting UPnP, HTTP (management web interface), and a custom network service from Realtek.” reported IoT Inspector.
“By exploiting these vulnerabilities, remote unauthenticated attackers can fully compromise the target device and execute arbitrary code with the highest level of privilege. We identified at least 65 different affected vendors with close to 200 unique fingerprints, thanks both to Shodan’s scanning capabilities and some misconfiguration by vendors and manufacturers who expose those devices to the Internet. Affected devices implement wireless capabilities and cover a wide spectrum of use cases: from residential gateways, travel routers, Wi-Fi repeaters, IP cameras to smart lightning gateways or even connected toys.”
Affected devices include routers, IP cameras, Wi-Fi repeaters and residential gateways from multiple brands, such as ASUS, Belkin, D-Link, Huawei, LG, Logitech, Netgear, ZTE and Zyxel.
The flaws were collectively tracked as CVE-2021-35392, CVE-2021-35393, CVE-2021-35394 and CVE-2021-35395 and SAM experts observed that the CVE-2021-35395 has been exploited in the wild to spread a Mirai bot.
“One of the vulnerabilities disclosed, CVE-2021-35395 [2], affects the web interface that is part of the SDK, and is a collection of 6 different vulnerabilities. As of August 18th, we have identified attempts to exploit CVE-2021-35395 in the wild.” states SAM experts. “Specifically, we noticed exploit attempts to “formWsc” and “formSysCmd” web pages. The exploit attempts to deploy a Mirai variant detected in March by Palo Alto Networks [3]. Mirai is a notorious IoT and router malware circulating in various forms for the last 5 years. It was originally used to shut down large swaths of the internet but has since evolved into many variants for different purposes.”
The Mirai variant involved in the attack is the same spotted by Palo Alto Networks researchers in March. In March the bot had been exploiting 10 vulnerabilities to hijack IoT devices.
On August 6, Juniper Networks reported that threat actors were actively exploiting a critical authentication bypass vulnerability, tracked as CVE-2021-20090, impacting home routers with Arcadyan firmware to deploy a Mirai bot, the same variant exploiting the CVE-2021-35395 flaws.
“According to SAM’s own research of connected devices, based on anonymously collected network data spanning more than 2M home and business networks, the following devices are the most common devices with the Realtek SDK: Netis E1+ extender, Edimax N150 and N300 Wi-Fi router, Repotec RP-WR5444 router,” continues SAM. “These devices are used mainly to enhance Wi-Fi reception.”
SAM experts published full attack details along with indicators of compromise (IOCs) for the recent attacks.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, InkySquid)
[adrotate banner=”5″]
[adrotate banner=”13″]
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Realtek)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/121400/cyber-crime/realtek-sdk-flaws-mirai-bot.html