CVE-2021-35394
KEVRealtek Jungle SDK Remote Code Execution Vulnerability
Description
RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.
Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPublishedAug 16, 2021
Last modifiedJun 17, 2026
Added to KEVDec 10, 2021
Remediation dueDec 24, 2021
References
- iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chainBroken LinkExploit
- realtek.com/en/cu-1-en/cu-1-taiwan-enBroken LinkPatch
- realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdfPatchVendor Advisory
- securityfocus.com/archive/1/534765Broken LinkThird Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35394US Government Resource
0 recent articles mention this CVE
89
Risk assessment · Critical
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1767 days
- CVSS
- 9.8 CRITICAL
- EPSS (30-day exploit probability)
- 99.9% · top 1% of all CVEs
- Weakness
- NVD-CWE-Other
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.