Realtek · SDK
CVE-2014-8361
Realtek SDK Improper Input Validation Vulnerability
What it is
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.
CISA: Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: October 9, 2023
- Added to the CISA list
- September 18, 2023
- Published
- May 1, 2015
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- >99.9% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-20
- More details
- NVD · CVE.org · CISA
All references (9)
- http://www.zerodayinitiative.com/advisories/ZDI-15-155/
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055
- http://packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-Command-Execution.html
- http://www.securityfocus.com/bid/74330
- https://www.exploit-db.com/exploits/37169/
- http://jvn.jp/en/jp/JVN47580234/index.html
- http://jvn.jp/en/jp/JVN67456944/index.html
- https://sensorstechforum.com/hinatabot-cve-2014-8361-ddos/
- https://web.archive.org/web/20150909230440/http://securityadvisories.dlink.com/security/publication.aspx?name…
More exploited flaws from Realtek
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Dec 10, 2021 | Jungle SDK Remote Code Execution | Jungle Software Development Kit (SDK) | Critical 9.8 | 99.9% |
| Nov 3, 2021 | Buffer Overflow | AP-Router SDK | Critical 9.8 | 98% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.