Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.
References
| Link | Resource |
|---|---|
| https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain | Broken Link Exploit Third Party Advisory |
| https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en | Broken Link Patch Vendor Advisory |
| https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf | Patch Vendor Advisory |
| https://www.securityfocus.com/archive/1/534765 | Broken Link Third Party Advisory VDB Entry |
| https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain | Broken Link Exploit Third Party Advisory |
| https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en | Broken Link Patch Vendor Advisory |
| https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf | Patch Vendor Advisory |
| https://www.securityfocus.com/archive/1/534765 | Broken Link Third Party Advisory VDB Entry |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35394 | US Government Resource |
Configurations
History
07 Nov 2025, 19:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35394 - US Government Resource |
Information
Published : 2021-08-16 12:15
Updated : 2025-11-07 19:01
NVD link : CVE-2021-35394
Mitre link : CVE-2021-35394
CVE.ORG link : CVE-2021-35394
JSON object : View
Products Affected
realtek
- rtl819x_jungle_software_development_kit
CWE
NVD-CWE-Other
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')