Realtek SDK vulnerability exploitation attempts detected (CVE-2021-35395)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-35393 +1 in the same advisory: …35392 | Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or mini_upnpd and is the successor to miniigd. The server is vulnerable to a stack buffer overflow vulnerability that is present due to unsafe parsing of the UPnP SUBSCRIBE/UNSUBSCRIBE Callback header. Successful exploitation of this vulnerability allows remote unauthenticated attackers to gain arbitrary code execution on the affected device. NVD description · AI analysis pending | 9.8 group max | 70% | PoC |
| — | |
| CVE-2021-35394 | Remote Code Execution via Memory Corruption in Realtek Jungle SDK Realtek's Jungle SDK, a software development kit used to build firmware for a wide range of consumer and small-office networking devices (most notably routers), contains multiple memory corruption vulnerabilities that can be triggered remotely over the network; public disclosure tied the flaws to unauthenticated network-facing components bundled with the SDK, such as its UPnP and DHCP handling. An attacker who sends crafted packets to a vulnerable device can corrupt memory and, per the associated weakness types (CWE-78 command injection, CWE-138 improper neutralization), end up executing arbitrary code or operating-system commands with the privileges of the vulnerable service, effectively taking over the device. Because the SDK is licensed into many vendors' products rather than sold as a standalone application, exposure spans numerous router and embedded-device vendors, and end users may not even know their device relies on it. Exact affected SDK version ranges and per-vendor firmware lists were not specified in the available data, so defenders should rely on the latest vendor advisories. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2021-12-10, indicating confirmed exploitation in the wild; ransomware use is unknown and no public proof-of-concept is flagged in the available data. Do: Per CISA's required action, apply firmware updates per your device vendor's instructions, since patches are distributed by the vendors that build on the SDK rather than by Realtek directly. Identify whether your router or embedded device uses Realtek Jungle SDK-based firmware (check the vendor's model/advisory pages) and prioritize updating internet-facing devices. Where patched firmware is not yet available, restrict direct internet exposure (firewall the WAN side) and disable or limit UPnP/DHCP-related exposed services if the vendor supports doing so, while monitoring vendor advisories. | 9.8 | 100% | KEV PoC |
| mass≈ millions of devices (SDK embedded in consumer router/IoT firmware across many vendors; at least ~100,000 likely internet-exposed) | |
| CVE-2021-35395 | Multiple Stack Buffer Overflows and Command Injection in Realtek Jungle SDK Web Server The Realtek Jungle SDK (v2.x up to v3.4.14B) ships an HTTP management web server, in both Go-Ahead ('webs') and Boa ('boa') variants, containing multiple stack buffer overflows in form handlers such as formRebootCheck, formWsc, formWlanMultipleAP, formWlSiteSurvey and formStaticDHCP, plus arbitrary command execution/injection flaws in formSysCmd and formWsc. An unauthenticated attacker triggers these by sending crafted HTTP requests with oversized submit-url, ifname, hostname or peerPin parameters, or by injecting commands via the sysCmd or peerPin parameters. Successful exploitation yields arbitrary code execution on the device, typically giving the attacker full control of the affected router, access point or IoT device. Any device whose vendor embedded the affected SDK is exposed, with public reporting linking the flaws to roughly 65 downstream vendors and nearly a million internet-visible devices. Exploitation is confirmed in the wild: the issue is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), and researchers observed Mirai botnet variants and other attackers compromising Realtek-based devices; ransomware use is unknown. Do: Apply firmware updates from your device vendor incorporating a patched Realtek SDK (newer than v3.4.14B), per CISA's required action; since vendors ship modified builds, confirm with the manufacturer that your model is fixed. Until patched, disable remote/web-based administration or restrict the management interface (WAN-facing HTTP) with a firewall so it is not internet-exposed. Defenders should also monitor Realtek-based devices for botnet-style activity (e.g., Mirai-variant traffic), as a public PoC/advisory from IoT Inspector is available and exploitation is ongoing. | 9.8 | 98% | KEV PoC |
| mass≈1,000,000 internet-exposed devices (public scans reported nearly a million Realtek-based devices) |
Full article472 words · extracted from helpnetsecurity.com · click to collapse
Threat actors are attempting to exploit CVE-2021-35395, a group of vulnerabilities in the web interface of the Realtek SDK, to spread Mirai malware to vulnerable IoT devices.
A recently revealed flaw
A week ago, IoT Inspector researchers released details about four CVE-numbered flaws (CVE-2021-35392, CVE-2021-35393, CVE-2021-35394, and CVE-2021-35395) affecting the Realtek SDK, which comes with a specific system on a chip (SoC) manufactured by Taiwanese semiconductor company Realtek.
The SoC in question – the Realtek RTL819xD chipset – is found in many embedded devices in the IoT space.
“We identified at least 65 different affected vendors with close to 200 unique fingerprints, thanks both to Shodan’s scanning capabilities and some misconfiguration by vendors and manufacturers who expose those devices to the Internet,” the researchers shared.
“Affected devices implement wireless capabilities and cover a wide spectrum of use cases: from residential gateways, travel routers, Wi-Fi repeaters, IP cameras to smart lightning gateways or even connected toys.”
Realtek has since patched the vulnerabilities, but it will take a while for manufacturers who use their chipset to port and make available patches to their customers, and likely even longer for the customers to implement the provided patches / security updates.
CVE-2021-35395 exploitation attempts
CVE-2021-35395 exploitation attempts have been flagged by Israeli network security company SAM Seamless Network, which detected them via their home security solution.
“Specifically, we noticed exploit attempts to ‘formWsc’ and ‘formSysCmd’ web pages. The exploit attempts to deploy a Mirai variant detected in March by Palo Alto Networks,” Omri Mallis, the company’s Chief Product Archited, shared.
He also noted that a similar incident was reported on August 6th by Juniper Networks – the company detected a newly discovered vulnerability affecting Arcadyan-based routers (CVE-2021–20090) getting exploited in the wild only two days after publication, and the attackers’ goal was to spread the same Mirai variant.
“The webserver serving the Mirai botnet uses the same network subnet, indicating that the same attacker is involved in both incidents,” Mallis added.
“This chain of events shows that hackers are actively looking for command injection vulnerabilities and use them to propagate widely used malware quickly. These kinds of vulnerabilities are easy to exploit and can be integrated quickly into existing hacking frameworks that attackers employ, well before devices are patched and security vendors can react.”
SAM’s researchers have analyzed anonymously collected network data from more than 2 million home and business networks, and found that a Wi-Fi extender by Netic and two routers by Edimax and Repotec are the the most common devices with the Realtek SDK.
Users of IoT devices would do well to check the (incomplete) list of affected manufacturers and device models to see whether their devices are vulnerable, and then wheter the manufacturers have already provided a patch. If they haven’t, they should urge them to do it quickly.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/08/24/cve-2021-35395-exploitation/