CVE-2014-8361
📋 TL;DR
CVE-2014-8361 is a critical remote code execution vulnerability in the miniigd UPnP SOAP service in Realtek SDK. It allows unauthenticated attackers to execute arbitrary code on affected devices via crafted NewInternalClient requests. This vulnerability affects numerous embedded devices (routers, IoT devices) using Realtek SDK and has been actively exploited for years.
💻 Affected Systems
- D-Link routers
- TP-Link routers
- Netgear routers
- ASUS routers
- Other embedded devices using Realtek SDK
📦 What is this software?
Realtek Sdk by Realtek
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to botnet recruitment, data exfiltration, lateral movement into internal networks, and persistent backdoor installation.
Likely Case
Device takeover for botnet participation, credential theft, and use as pivot point for internal network attacks.
If Mitigated
Limited impact if devices are behind firewalls with UPnP disabled and network segmentation in place.
🎯 Exploit Status
Exploit code publicly available since 2014, actively exploited in the wild through 2023. Simple HTTP POST request triggers vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Vendor-specific firmware updates
Vendor Advisory: http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055
Restart Required: Yes
Instructions:
1. Identify device model and current firmware version. 2. Check manufacturer website for security updates. 3. Download latest firmware. 4. Apply firmware update via device web interface. 5. Reboot device.
🔧 Temporary Workarounds
Disable UPnP Service
allDisable the Universal Plug and Play service which hosts the vulnerable miniigd component
Device-specific: Typically via web interface under Advanced Settings > UPnP
Block External UPnP Requests
linuxConfigure firewall to block incoming UPnP requests (port 1900/udp and 5000/tcp typical)
iptables -A INPUT -p udp --dport 1900 -j DROP
iptables -A INPUT -p tcp --dport 5000 -j DROP
🧯 If You Can't Patch
- Segment affected devices on isolated network VLAN
- Implement strict firewall rules blocking all inbound traffic to affected devices
🔍 How to Verify
Check if Vulnerable:
Check if UPnP service is running on ports 1900/udp or 5000/tcp. Use nmap: nmap -sU -p 1900 <target> and nmap -sT -p 5000 <target>Check Version:
Device-specific: Typically via web interface or telnet/ssh to device and check firmware versionVerify Fix Applied:
Verify UPnP service is disabled or patched firmware version is installed. Check firmware version matches vendor's patched version.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /soap.cgi or similar UPnP endpoints
- Unusual process execution from web service context
- Failed authentication attempts followed by successful exploit
Network Indicators:
- HTTP POST to port 5000/tcp with SOAP XML containing NewInternalClient
- Unusual outbound connections from embedded devices
SIEM Query:
source_port=5000 AND http_method=POST AND (uri_path="*soap*" OR http_user_agent="*UPnP*")🔗 References
- http://jvn.jp/en/jp/JVN47580234/index.html
- http://jvn.jp/en/jp/JVN67456944/index.html
- http://packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-Command-Execution.html
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055
- http://www.securityfocus.com/bid/74330
- http://www.zerodayinitiative.com/advisories/ZDI-15-155/
- https://sensorstechforum.com/hinatabot-cve-2014-8361-ddos/
- https://web.archive.org/web/20150909230440/http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055
- https://www.exploit-db.com/exploits/37169/
- http://jvn.jp/en/jp/JVN47580234/index.html
- http://jvn.jp/en/jp/JVN67456944/index.html
- http://packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-Command-Execution.html
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055
- http://www.securityfocus.com/bid/74330
- http://www.zerodayinitiative.com/advisories/ZDI-15-155/
- https://sensorstechforum.com/hinatabot-cve-2014-8361-ddos/
- https://web.archive.org/web/20150909230440/http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055
- https://www.exploit-db.com/exploits/37169/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-8361
