The vulnerability in the implementation of the SSDP protocol for the WiFi Simple Config server (wscd) in the Realtek SDK development tools allows a hacker to execute arbitrary code.

🗓️ 17 Aug 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Remote code execution flaw in Realtek wscd service discovery protocol via stack overflow with subscribe unsubscribe.

Reporter	Title	Published	Views	Family All 36
ATTACKERKB	CVE-2021-35395	16 Aug 202100:00	–	attackerkb
ATTACKERKB	CVE-2021-35394	16 Aug 202100:00	–	attackerkb
BDU FSTEC	The vulnerability of the UPnP protocol implementation in the WiFi Simple Config (wscd) server from the Realtek SDK allows a hacker to execute arbitrary code.	17 Aug 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the MP Daemon diagnostic tool developed by Realtek SDK allows a hacker to execute arbitrary code.	17 Aug 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability in the web interface for managing Realtek SDK devices allows a hacker to execute arbitrary code.	17 Aug 202100:00	–	bdu_fstec
Circl	CVE-2021-35392	16 Aug 202116:14	–	circl
Circl	CVE-2021-35393	16 Aug 202116:14	–	circl
CNNVD	Realtek Jungle SDK 安全漏洞	16 Aug 202100:00	–	cnnvd
CNNVD	Realtek Jungle SDK 安全漏洞	16 Aug 202100:00	–	cnnvd
CNNVD	Realtek Jungle SDK 缓冲区错误漏洞	16 Aug 202100:00	–	cnnvd

Vulners

Node

realtek_semiconductor realtek_sdkRange<3.2.3

OR

realtek_semiconductor realtek_sdkRange<3.4.11e

Source	Link
realtek	www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-35393
anti-malware	www.anti-malware.ru/news/2021-08-16-111332/36688
iot-inspector	www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain/
web	www.web.nvd.nist.gov/view/vuln/detail

19 Aug 2021 00:00Current

8.6High risk

Vulners AI Score8.6

CVSS 27.6

CVSS 38.1

EPSS0.7355

Realtek wscd service discovery protocol remote code execution stack overflow subscribe unsubscribe