CriticalCVE-2021-35395

    Realtek AP-Router SDK Buffer Overflow Vulnerability (CVE-2021-35395)

    Published In CISA KEV since Sources: SingCERT, CVE.org

    Share

    What is affected, what to do

    Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface exists: one based on Go-Ahead named webs and another based on Boa named boa.

    The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • Realtek AP-Router SDK lte 2.0..3.4.14b

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    9.8

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    9.8

    CVSS v3

    Severity Critical on the scale from 0 to 10.

    Source: SingCERT, CVE.org

    98.1 %

    EPSS score

    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.

    Source: FIRST EPSS, percentile 99.91

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    228.86 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploitedSource: CSA/SingCERT How we classify
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    9.8 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    9.8
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    98.1 %
    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    99.91
    Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    CISA assessment (SSVC)
    Exploitation: active · automatable · Technical impact: total
    Source: CISA Vulnrichment, as of 4 February 2025

    Response and mitigation

    Why act now?

    Prioritisation rationale

    This CVE sits on KEV because it is unauthenticated, network-reachable and carries one of the highest exploitation-likelihood ratings observed. Attackers have been using it since 2021 for mass recruitment into Mirai, Mozi and Dark-IoT botnets; the barrier to entry is minimal thanks to public Metasploit modules and PoCs. For NIS2-scoped organisations, the real risk sits in branch-office CPE, factory-floor APs, surveillance cameras and poorly maintained edge routers — any of which can become a pivot into the internal network. Treat every internet-facing Realtek-SDK device as P1, and internally segmented devices with management access from office VLANs as P2.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Inventory all devices built on the Realtek Jungle SDK (v2.x through v3.4.14B). Affected categories include SOHO routers, Wi-Fi access points, repeaters, IP cameras and smart-home gateways from many OEMs (D-Link, Netgear, Zyxel, TP-Link OEM, LG, Edimax, others). Cross-check the FCC-ID or vendor firmware changelog for the SDK version.
      • Deploy OEM firmware updates as soon as published. Realtek released fixes in SDK 3.4.14B+, but the actual patch must come from the device manufacturer. For EOL hardware with no fix, schedule replacement — no workaround substitutes for the patch long-term.
      • Immediately remove the HTTP/HTTPS management interface (Boa/Go-Ahead webserver, typically TCP/80 and TCP/443) from the WAN side; disable remote management entirely.
      • Move affected devices into an isolated management VLAN; restrict access to the web UI to a single jump-host IP via upstream L3 switch or perimeter ACL.
      • Rotate admin credentials and remove any default accounts — exploitation of the formSysCmd and peerPin paths is commonly chained with credential spraying by Mirai/Mozi variants.
      • For internet-exposed devices without an available patch: take them offline, or front them with an authenticating reverse proxy until firmware is updated.

    2. Runbook step 2

      Mitigation layers

      • Network segmentation: place IoT/CPE devices in a dedicated VLAN with strict egress filtering — outbound only to vendor update servers and DNS, no lateral access to office or OT segments. This also blocks typical Mirai re-infection on TCP/23, TCP/2323, TCP/37215, TCP/52869.
      • WAF/IPS rules: enable Suricata/Snort signatures covering CVE-2021-35395 (ET Open and Talos rulesets include SIDs for formWsc, formSysCmd, formWlSiteSurvey). Block HTTP POST requests to /goform/* carrying over-long values (>256 bytes) in submit-url, ifname, hostname, peerPin and sysCmd parameters.
      • Disable UPnP (TCP/2869, UDP/1900) on routers — it is a common pivot for discovering the Realtek SDK webserver.
      • Perimeter firewall: drop inbound TCP/80, TCP/443, TCP/8080, TCP/8443 towards CPE/IoT subnets; block outbound TCP/37215 and TCP/52869 (classic Mirai scanner ports).
      • Monitor DNS resolutions from the IoT VLAN against known C2 and loader domains (Mozi, Mirai derivatives); alert on hex-looking or DGA-style domains.
      • Subscribe to vendor and CISA/BSI advisory feeds so OEM firmware releases flow into patch management automatically.

    3. Runbook step 3

      Detection rules

      • Parse webserver access logs (where the OEM exports them) for POST requests to /goform/formSysCmd, /goform/formWsc, /goform/formWlSiteSurvey, /goform/formRebootCheck with parameter lengths well beyond normal form values. Sigma shape: selection: cs-uri-stem|contains: '/goform/form' AND cs-method: 'POST' AND cs-bytes > 500.
      • Suricata/Zeek: alert on HTTP payloads containing sysCmd= or peerPin= combined with shell metacharacters (;, |, `, $() — a clear command-injection signal.
      • NetFlow/Zeek conn logs: unusual inbound scanning on TCP/80 and TCP/443 towards CPE subnets; short-lived connections (<1 s) followed by TFTP (UDP/69), HTTP or Wget-pattern downloads indicate loader staging.
      • EDR or network sensors behind the CPE: sudden ARP sweeps or scanning from a router/AP host into internal RFC1918 ranges — a strong post-exploitation lateral-movement signal.
      • Threat-intel match: outbound traffic from the IoT VLAN to known Mozi/Mirai C2 IPs. KQL shape (Defender/Sentinel): DeviceNetworkEvents | where LocalIPType == "Private" and RemoteIPType == "Public" and RemotePort in (37215, 52869, 23, 2323).

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface exists: one based on Go-Ahead named webs and another based on Boa named boa. Both of them are affected by these vulnerabilities. Specifically, these binaries are vulnerable to the following issues: - stack buffer overflow in formRebootCheck due to unsafe copy of submit-url parameter - stack buffer overflow in formWsc due to unsafe copy of submit-url parameter - stack buffer overflow in formWlanMultipleAP due to unsafe copy of submit-url parameter - stack buffer overflow in formWlSiteSurvey due to unsafe copy of ifname parameter - stack buffer overflow in formStaticDHCP due to unsafe copy of hostname parameter - stack buffer overflow in formWsc due to unsafe copy of 'peerPin' parameter - arbitrary command execution in formSysCmd via the sysCmd parameter - arbitrary command injection in formWsc via the 'peerPin' parameter Exploitability of identified issues will differ based on what the end vendor/manufacturer did with the Realtek SDK webserver. Some vendors use it as-is, others add their own authentication implementation, some kept all the features from the server, some remove some of them, some inserted their own set of features. However, given that Realtek SDK implementation is full of insecure calls and that developers tends to re-use those examples in their custom code, any binary based on Realtek SDK webserver will probably contains its own set of issues on top of the Realtek ones (if kept). Successful exploitation of these issues allows remote attackers to gain arbitrary code execution on the device.

    Source: CSA/SingCERT, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    realtekrtl819x_jungle_software_development_kit
    • 2.0 – ≤ 3.4.14b
    • —

    Vendors and products

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited
    CSA/SingCERTCritical Vulnerability In Realtek Jungle Software Development Kit (SDK) (opens in a new tab)CSA/SingCERTactively exploited

    References & sources

    • realtek.comen/cu-1-en/cu-1-taiwan-enx_refsource_MISC, Broken link, Patch, Vendor advisory
    • realtek.comimages/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392…x_refsource_MISC, Patch
    • iot-inspector.comblog/advisory-multiple-issues-realtek-sdk-iot-supply-chainx_refsource_MISC, Broken link, Exploit, Third-party advisory
    • cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35395government-resource, US government resource
    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2021-35395
    <a href="https://intel.neosec.eu/en/cve/CVE-2021-35395"><img src="https://intel.neosec.eu/badge/cve/CVE-2021-35395.svg?lang=en" alt="CVE-2021-35395 – NEOSEC Intel" height="20"></a>