reaver-wps-fork-t6x

Overview Reaver implements a brute force attack against Wifi Protected Setup WPS registrar PINs in order to recover WPA/WPA2 passphrases , as described in Brute forcing Wi-Fi Protected Setup When poor design meets poor implementation. by Stefan Viehböck. Reaver has been designed to be a robust an...

TOTOLINK/Realtek Routers - Information Disclosure

A certain router administration interface using Realtek APMIB e.g., on TOTOLINK models allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the "config.dat" file. Affected devices include TOTOLINK A3002RU through 2.0.0...

TOTOLINK/Realtek Routers - Information Disclosure

A certain router administration interface using Realtek APMIB e.g., on TOTOLINK models allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the "config.dat" file. Affected devices include TOTOLINK A3002RU through 2.0.0...

cve-2022-27255

CVE-2022-27255 - Realtek eCos SDK SIP ALG buffer overflow This repository contains the materials for the talk "Exploring the hidden attack surface of OEM IoT devices: pwning thousands of routers with a vulnerability in Realtek’s SDK for eCos OS.", which was presented at DEFCON30. The contents of...

TOTOLINK/Realtek Routers - CAPTCHA Bypass

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload "topicurl":"setting/getSanvas". This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted...

rtl8812au

RTL8812AU/21AU and RTL8814AU linux driver with monitor mode and frame injection The master branch is based on https://github.com/ulli-kroll/rtl8821au branch v4.3.22-beta/rework. According to rtwversion.c the real driver version is 4.3.20. The branch v4.3.21 may be built for RTL8814AU or...

CVE-2026-98263

A flaw was found in the Linux kernel's Realtek RT712 audio codec driver. A local user could exploit this flaw to cause a Denial of Service DoS or unexpected system behavior. The issue arises because audio stream configuration data is left uninitialized before being passed to the SoundWire...

CVE-2026-51585

realtek poc rt26cx21x64.sys exploit Realtek PCIe GbE/2.5GbE/5GbE family Overview OID 0xFF816871 maps the nic's mmio bar into the calling proc's virtual addr space, MmLockedPagesSpecifyCache, reachable from um via \.\RealTekCardGUID This IOCTL 0x0012C818 is gated by a registry value DrvMode=4 Once...

CVE-2021-32537

CVE-2021-32537: Out-of-bounds access in RTKVHD64 leading to pool corruption. This is a bug that I reported to Realtek beginning of April 2021. The affected driver is named RTKVHD64.sys and seems to be available on a bunch of mainstream hardware tested the below hardware configurations but probabl...

CVE-2026-36355

CVE-2026-36355: Realtek rtl819x Jungle SDK - Unauthenticated Kernel Memory Read/Write via Debug ioctls CVE : CVE-2026-36355 CWE : CWE-782, CWE-787, CWE-200 Discoverer : Daniil Gordeev Disclosed : 2026-05-03 Summary The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x out-of-tree "Jungle SDK"...

lg-webos-kexec

lg-webos-kexec Boot a custom Linux kernel on a rooted LG webOS TV via kexec — in RAM, no secure-boot bypass. Status: work-in-progress. A custom kernel can be staged and reaches userspace, but it does not yet stay up as a usable OS. Target LG 50UP81009LR webOS 6.5, Realtek RTD2875, armv7l. Rooted...

Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit SDK to deploy a botnet malware called Cling. "Cling is notable not because it introduces a new propagation technique, but because it repurposes ordinar...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: irqchip/realtek-rtl: The refcount leak in mapinterrupts has been fixed. The offindnodebyphandle function returns a node pointer with a incremented refcount. We should use ofnodeput on it when there is no longer a need for it. Thi...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drivers: staging: rtl8192u: Fixed a deadlock in ieee80211beaconsstop. There is a deadlock in ieee80211beaconsstop, as shown below: Thread 1 | Thread 2 | ieee80211sendbeacon ieee80211beaconsstop | modtimer spinlockirqsave //1 | Wa...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Staging: r8188eu: prevented -Ssid overflow in rtwwxsetscan This code includes a check to prevent read overflow, but another check is needed to prevent writing beyond the end of the -Ssid array...

RealTek Jungle SDK - Arbitrary Command Injection

There is a command injection vulnerability on the "formWsc" page of the management interface. Successful exploitation of this vulnerability could lead to remote code execution and compromise of the affected system. id: CVE-2021-35395 info: name: RealTek Jungle SDK - Arbitrary Command Injection...

CVE-2026-97500

A flaw was found in the Linux kernel's Realtek Wi-Fi driver rtw89. The driver fails to validate the length of physical layer PHY status information elements before parsing received data. A malicious or malfunctioning wireless device could exploit this flaw by providing status data with an...

CVE-2026-97907

A flaw was found in the Linux kernel's Realtek Bluetooth driver. When processing firmware images on hardware where the chip key identifier is zero, the driver incorrectly manages loop control and evaluates an uninitialized or stale return code. A local user capable of providing firmware or...

kj33-cpe-root-shell

One POST to root: the "Wi-Fi 6" 5G CPE that isn't A carrier...

ROS-20260925-73-0172

The vulnerability of the rtl8187rxcb function in the driver file drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c of the Realtek wireless communication adapter driver for the Linux operating system is related to improper cleanup or release of resources. Exploiting this vulnerability could allow...