CVE-2014-8361
Realtek SDK Improper Input Validation Vulnerability
Description
CVE-2014-8361 is a critical remote code execution vulnerability in the Realtek SDK, specifically in the miniigd SOAP service used by numerous home routers. An attacker can exploit this vulnerability by sending a crafted NewInternalClient request to execute arbitrary code on the affected device without any authentication. This Realtek SDK vulnerability impacts a wide range of D-Link routers (including DIR-905L, DIR-605L, DIR-600L, DIR-619L, and others) as well as NEC Aterm devices, making it a significant supply chain security concern. CISA has added CVE-2014-8361 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild through 2023, and its EPSS score of 94.0% places it in the 99th percentile for exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dir-905l firmware | <= 2.05b01 |
| dlink | dir-605l firmware | <= 1.14b06; <= 2.07b02; <= 3.03b07 |
| dlink | dir-600l firmware | <= 1.15; <= 2.056b06 |
| dlink | dir-619l firmware | <= 1.15; <= 2.07b02 |
| dlink | dir-809 firmware | <= 1.04b02 |
| dlink | dir-900l firmware | < 1.15b01 |
| realtek | realtek sdk | - |
| dlink | dir-501 firmware | <= 1.01b04 |
| dlink | dir-515 firmware | <= 1.01b04 |
| dlink | dir-615 firmware | 10.01b02; <= 6.06b03 |
| aterm | wg1900hp2 firmware | <= 1.3.1 |
| aterm | wg1900hp firmware | <= 2.5.1 |
| aterm | wg1800hp4 firmware | <= 1.3.1 |
| aterm | wg1800hp3 firmware | <= 1.5.1 |
| aterm | wg1200hs2 firmware | <= 2.5.0 |
| aterm | wg1200hp3 firmware | <= 1.3.1 |
| aterm | wg1200hp2 firmware | <= 2.5.0 |
| aterm | w1200ex firmware | <= 1.3.1 |
| aterm | w1200ex-ms firmware | <= 1.3.1 |
| aterm | wg1200hs firmware | All versions |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://jvn.jp/en/jp/JVN47580234/index.html(Third Party Advisory)
- http://jvn.jp/en/jp/JVN67456944/index.html(Third Party Advisory)
- http://packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-Command-Execution.html(Third Party Advisory, VDB Entry)
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055(Vendor Advisory)
- http://www.securityfocus.com/bid/74330(Broken Link, Third Party Advisory, VDB Entry)
- http://www.zerodayinitiative.com/advisories/ZDI-15-155/(Third Party Advisory, VDB Entry)
- https://sensorstechforum.com/hinatabot-cve-2014-8361-ddos/(Third Party Advisory)
- https://web.archive.org/web/20150909230440/http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055(Third Party Advisory)
- https://www.exploit-db.com/exploits/37169/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-8361(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2014-8361 in the NVD database. However, the vulnerability involves improper handling of SOAP requests in the miniigd service, allowing remote code execution through crafted UPnP requests. The underlying weakness relates to insufficient input validation in the NewInternalClient request handler.
Learn more: CWE Overview
Impact Analysis
CVE-2014-8361 carries a CVSS v3.1 score of 9.8 (Critical), reflecting its severe exploitability characteristics. The vulnerability is remotely exploitable without physical access via the network attack vector, is easy to exploit with no special conditions needed, requires no authentication or user interaction, and results in complete compromise of confidentiality, integrity, and availability. Confidentiality (High): Attackers can read all data on the compromised router, including network credentials and traffic. Integrity (High): Full control over the device allows attackers to modify firmware, DNS settings, and route traffic through malicious servers. Availability (High): Compromised routers can be recruited into botnets for DDoS attacks, as evidenced by the HinataBot campaign leveraging this vulnerability. With an EPSS score of 94.0%, this vulnerability has a near-certain probability of active exploitation, making immediate remediation essential.
Exploit Maturity
Public exploit code is available for CVE-2014-8361 via Exploit Database and Packet Storm Security, with additional details from the Zero Day Initiative advisory ZDI-15-155. CISA has confirmed active exploitation of CVE-2014-8361 in the wild, with exploitation observed through 2023 including use in botnet campaigns such as HinataBot. The EPSS score of 94.0% indicates near-certain exploitation activity, placing this vulnerability in the 99th percentile. Given the widespread availability of exploit code and the large number of affected consumer routers, this vulnerability remains a high-priority threat.
Remediation
- Apply vendor mitigations or discontinue use of affected products as directed by CISA (remediation deadline: October 9, 2023). For D-Link routers, check the D-Link security advisory SAP10055 for firmware updates; many affected D-Link models have reached end of life and should be replaced.
- Update Realtek SDK-based firmware to a version that patches the miniigd SOAP service vulnerability. Contact your device vendor for patched firmware builds that incorporate the Realtek SDK fix.
- Disable UPnP on all affected routers immediately. The vulnerability is in the miniigd UPnP SOAP service, so disabling UPnP removes the attack surface. Also restrict WAN-side access to management interfaces.
- Monitor network traffic for unusual UPnP SOAP requests, particularly crafted NewInternalClient requests. Review device logs for indicators of compromise, including unexpected outbound connections or DNS setting changes that may indicate botnet recruitment.
- Segment IoT and network devices behind a firewall that blocks unsolicited inbound traffic to UPnP ports (typically TCP 52869). Consider replacing end-of-life routers with actively supported hardware that receives regular security updates.
Technical Details
The CVE-2014-8361 vulnerability resides in the miniigd SOAP service, a component of the Realtek SDK that implements UPnP (Universal Plug and Play) functionality on embedded devices. The service fails to properly validate input in the NewInternalClient SOAP action, allowing an attacker to inject and execute arbitrary commands on the underlying operating system. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that this is a network-accessible vulnerability with low attack complexity, requiring no privileges or user interaction, resulting in complete system compromise. The vulnerability affects the Realtek SDK itself, meaning any device manufacturer that incorporated the vulnerable SDK version into their router firmware inherits the flaw — this supply chain impact explains the broad range of affected products spanning D-Link, NEC Aterm, and other vendors.
Frequently Asked Questions
Is CVE-2014-8361 being actively exploited?
Yes, CVE-2014-8361 is actively exploited in the wild. CISA has confirmed its inclusion in the Known Exploited Vulnerabilities catalog, with exploitation observed through 2023. The EPSS score of 94.0% further indicates near-certain exploitation activity, and the vulnerability has been leveraged in botnet campaigns targeting consumer routers.
What products are affected by CVE-2014-8361?
CVE-2014-8361 affects the Realtek SDK and numerous routers that incorporate it, including D-Link models DIR-905L, DIR-605L, DIR-600L, DIR-619L, DIR-809, DIR-900L, DIR-501, DIR-515, and DIR-615. NEC Aterm devices are also affected, including models WG1900HP2, WG1900HP, WG1800HP4, WG1800HP3, WG1200HS2, WG1200HP3, WG1200HP2, W1200EX, W1200EX-MS, and WG1200HS.
How do I fix CVE-2014-8361?
Apply firmware updates from your device manufacturer if available. For many affected D-Link routers that have reached end of life, the recommended action is to replace the device entirely. As an immediate mitigation, disable UPnP on affected routers and block inbound traffic to UPnP ports.
How severe is CVE-2014-8361?
CVE-2014-8361 is rated Critical with a CVSS v3.1 score of 9.8 out of 10. It allows unauthenticated remote code execution and is in the 99th percentile for exploitation probability. The combination of public exploit availability, active exploitation, and the large number of affected consumer devices makes this one of the most severe embedded device vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.