CVE-2021-35392
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on affected devices via a heap buffer overflow in Realtek Jungle SDK's WiFi Simple Config server. Attackers can exploit this by sending specially crafted SSDP NOTIFY messages in response to M-SEARCH requests. This affects IoT devices, routers, and other embedded systems using Realtek SDK versions v2.x through v3.4.14B.
💻 Affected Systems
- Realtek Jungle SDK
- Various IoT devices using Realtek SDK
- Routers with Realtek chipsets
- Embedded systems with Realtek WiFi modules
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, enabling attackers to install malware, pivot to internal networks, or create botnet nodes.
Likely Case
Remote code execution allowing attackers to gain control of vulnerable devices, potentially leading to data theft, network reconnaissance, or denial of service.
If Mitigated
Limited impact if devices are behind firewalls with SSDP/UPnP traffic blocked and network segmentation is implemented.
🎯 Exploit Status
Exploitation requires network access to the vulnerable service (port 1900/udp typically). The vulnerability is in SSDP protocol handling, which is widely implemented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.4.14C and later
Vendor Advisory: https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf
Restart Required: Yes
Instructions:
1. Check device manufacturer for firmware updates. 2. Apply firmware update from device vendor. 3. Reboot device after update. 4. Verify wscd/mini_upnpd service is updated.
🔧 Temporary Workarounds
Disable SSDP/UPnP service
linuxDisable the vulnerable wscd or mini_upnpd service to prevent exploitation.
killall wscd
killall mini_upnpd
systemctl disable wscd
systemctl disable mini_upnpd
Block SSDP traffic at firewall
linuxBlock UDP port 1900 and related UPnP traffic to prevent remote exploitation.
iptables -A INPUT -p udp --dport 1900 -j DROP
iptables -A OUTPUT -p udp --dport 1900 -j DROP
🧯 If You Can't Patch
- Segment affected devices on isolated network segments
- Implement strict firewall rules blocking all SSDP/UPnP traffic (UDP 1900) to/from affected devices
🔍 How to Verify
Check if Vulnerable:
Check if wscd or mini_upnpd process is running and check SDK version: ps aux | grep -E 'wscd|mini_upnpd'Check Version:
Check device firmware version via vendor-specific commands or web interfaceVerify Fix Applied:
Verify firmware version is v3.4.14C or later and wscd/mini_upnpd process is not vulnerable version📡 Detection & Monitoring
Log Indicators:
- Multiple SSDP NOTIFY messages from single source
- wscd/mini_upnpd process crashes
- Memory corruption errors in system logs
Network Indicators:
- Unusual SSDP traffic patterns
- SSDP NOTIFY messages with malformed ST headers
- Traffic to UDP port 1900 from unexpected sources
SIEM Query:
source_port=1900 AND (protocol=UDP) AND (event_description CONTAINS 'SSDP' OR event_description CONTAINS 'UPnP')🔗 References
- https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain
- https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en
- https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf
- https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain
- https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en
- https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf
