Actively exploited in the wild

Realtek Jungle SDK Remote Code Execution Vulnerability

Realtek - Jungle Software Development Kit (SDK) · Listed in the CISA KEV since 2021-12-10. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2021-35394

CriticalCVSS 9.8KEV

Published: 16/08/2021(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.

Risk Assessment

A remote attacker can exploit these vulnerabilities to execute arbitrary code on devices using the SDK, potentially leading to full device and network compromise.

Recommendation

Update Realtek Jungle SDK to the latest available version with fixes and restrict access to the UDPServer service.

Other vulnerabilities in Realtek Jungle SDK

CVE-2021-35395CriticalActively exploited
Realtek Jungle SDK versions v2.x through v3.4.14B includes an HTTP web server exposing a management interface (webs or boa) that is affected by multiple stack buffer overflows and arbitrary command execution flaws. The issues occur in functions such as formRebootCheck, formWsc, formWlanMultipleAP, formWlSiteSurvey, formStaticDHCP, and formSysCmd due to unsafe copying of parameters like submit-url, ifname, hostname, peerPin, and sysCmd. Successful exploitation allows remote attackers to achieve arbitrary code execution on the device.

Original NVD description (English source)