CVE-2021-35393
📋 TL;DR
This vulnerability allows remote unauthenticated attackers to execute arbitrary code on affected devices by exploiting a stack buffer overflow in Realtek Jungle SDK's WiFi Simple Config server. The vulnerability affects devices using Realtek SDK versions v2.x through v3.4.14B that have the wscd or mini_upnpd service enabled. This primarily impacts IoT devices, routers, and embedded systems in the supply chain.
💻 Affected Systems
- Realtek Jungle SDK-based devices
- IoT devices using Realtek chipsets
- Various routers and embedded systems
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, lateral movement within networks, and potential botnet recruitment.
Likely Case
Remote code execution allowing attackers to steal credentials, intercept network traffic, or use device as pivot point for further attacks.
If Mitigated
Limited impact if service is disabled or network segmentation prevents external access.
🎯 Exploit Status
Exploitation is straightforward due to the buffer overflow in UPnP SUBSCRIBE/UNSUBSCRIBE Callback header parsing. Public exploit code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.4.14C and later
Vendor Advisory: https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf
Restart Required: Yes
Instructions:
1. Contact device manufacturer for updated firmware. 2. Apply firmware update. 3. Reboot device. 4. Verify wscd/mini_upnpd service is updated.
🔧 Temporary Workarounds
Disable vulnerable service
linuxStop and disable the wscd or mini_upnpd service
systemctl stop wscd
systemctl disable wscd
killall wscd
killall mini_upnpd
Block UPnP/SSDP traffic
linuxUse firewall rules to block UPnP (1900/udp) and SSDP traffic
iptables -A INPUT -p udp --dport 1900 -j DROP
iptables -A INPUT -p tcp --dport 1900 -j DROP
🧯 If You Can't Patch
- Network segmentation: Isolate affected devices in separate VLANs
- Implement strict firewall rules to block all inbound traffic to vulnerable devices
🔍 How to Verify
Check if Vulnerable:
Check if wscd or mini_upnpd process is running: ps aux | grep -E 'wscd|mini_upnpd'Check Version:
Check device firmware version or contact manufacturer for SDK version informationVerify Fix Applied:
Verify service version or check that vulnerable service is no longer running📡 Detection & Monitoring
Log Indicators:
- Unusual UPnP SUBSCRIBE/UNSUBSCRIBE requests
- wscd/mini_upnpd process crashes
- Memory corruption errors in system logs
Network Indicators:
- Malformed UPnP packets to port 1900
- Unusual outbound connections from affected devices
SIEM Query:
source="*syslog*" AND (process="wscd" OR process="mini_upnpd") AND (message="*segmentation fault*" OR message="*buffer overflow*")🔗 References
- https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain
- https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en
- https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf
- https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain
- https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en
- https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf
