CVE-2021-35395
Realtek AP-Router SDK Buffer Overflow Vulnerability
Description
CVE-2021-35395 is a critical-severity buffer overflow and command injection vulnerability affecting the Realtek Jungle SDK (AP-Router SDK). The Realtek SDK provides an HTTP web server with a management interface available in two implementations (Go-Ahead "webs" and Boa "boa"), both of which contain multiple stack buffer overflow vulnerabilities due to unsafe copying of overly long user-supplied parameters, as well as arbitrary command execution flaws. An unauthenticated remote attacker can exploit these vulnerabilities to achieve arbitrary code execution on affected devices. CISA has added CVE-2021-35395 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 93.66% (99.8th percentile), exploitation is nearly certain for exposed devices.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| realtek | rtl819x jungle software development kit | >= 2.0, <= 3.4.14b |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain(Broken Link, Exploit, Third Party Advisory)
- https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en(Broken Link, Patch, Vendor Advisory)
- https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf(Patch)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35395(US Government Resource)
Weakness Type
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The Realtek Jungle SDK web server performs unsafe copies of user-supplied parameters (such as submit-url, ifname, hostname, and peerPin) into fixed-size stack buffers without verifying input length. This classic buffer overflow condition allows attackers to overwrite adjacent memory and hijack program execution flow.
Learn more: CWE-120 — Buffer Copy without Checking Size of Input
Impact Analysis
CVE-2021-35395 carries a CVSS 3.1 score of 9.8 (CRITICAL), representing one of the most severe threat levels. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and demands no user interaction. Successful exploitation fully compromises data confidentiality, system integrity, and service availability on the affected device. With an EPSS score of 93.66% (99.8th percentile), exploitation is near-certain for any exposed Realtek SDK-based device. Given that the Realtek Jungle SDK is embedded in a wide range of IoT routers and access points from numerous manufacturers, the supply-chain impact is substantial, potentially affecting millions of devices worldwide.
Exploit Maturity
CVE-2021-35395 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is available via IoT Inspector's advisory, which details the specific vulnerable functions and attack vectors. The EPSS score of 93.66% (99.8th percentile) indicates near-certain exploitation activity, reflecting widespread targeting of IoT devices running affected Realtek SDK firmware. Federal agencies were required to remediate this vulnerability by 2021-11-17 per CISA's binding operational directive.
Remediation
- Apply vendor firmware updates immediately as mandated by CISA KEV: Apply updates per vendor instructions. Check with your specific device manufacturer for firmware releases that incorporate the patched Realtek Jungle SDK (version 3.4.14B or later).
- Verify that all IoT devices, routers, and access points built on the Realtek Jungle SDK (rtl819x Jungle Software Development Kit versions 2.0 through 3.4.14b) have been updated to patched firmware versions.
- If immediate patching is not possible, isolate affected devices on a segmented network and restrict access to the web management interface by blocking HTTP/HTTPS management ports from untrusted networks using firewall rules.
- Disable the web-based management interface entirely if it is not required for operations, and use alternative management methods (serial console, SSH) where available.
- Monitor network traffic for exploitation attempts targeting the known vulnerable endpoints (formRebootCheck, formWsc, formWlanMultipleAP, formWlSiteSurvey, formStaticDHCP, formSysCmd) and review device logs for indicators of compromise.
Technical Details
CVE-2021-35395 affects the Realtek Jungle SDK's HTTP web server, which provides a management interface through two binary implementations: Go-Ahead ("webs") and Boa ("boa"). Both binaries contain multiple stack buffer overflow vulnerabilities caused by unsafe string copy operations on user-supplied HTTP form parameters, including submit-url, ifname, hostname, and peerPin across functions such as formRebootCheck, formWsc, formWlanMultipleAP, formWlSiteSurvey, and formStaticDHCP. Additionally, the formSysCmd function allows arbitrary command execution via the sysCmd parameter, and formWsc permits command injection through the peerPin parameter. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-accessible attack surface requiring no privileges, authentication, or user interaction, with complete impact across all three CIA triad dimensions. Because the Realtek SDK is redistributed to numerous OEM manufacturers, the actual attack surface varies depending on vendor customization, though most implementations retain at least some of the vulnerable code paths.
Frequently Asked Questions
Is CVE-2021-35395 being actively exploited?
Yes. CVE-2021-35395 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 93.66% (99.8th percentile) further indicates near-certain exploitation activity targeting exposed devices.
What products are affected by CVE-2021-35395?
CVE-2021-35395 affects the Realtek Jungle SDK (rtl819x Jungle Software Development Kit) versions 2.0 through 3.4.14b. Because this SDK is embedded in routers and access points from many OEM manufacturers, a wide range of consumer and enterprise IoT devices are potentially affected.
How do I fix CVE-2021-35395?
Apply firmware updates from your device manufacturer that incorporate the patched Realtek Jungle SDK. If no patch is available, restrict network access to the device's management interface and consider disabling the web management interface entirely.
How severe is CVE-2021-35395?
CVE-2021-35395 has a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity tier. Combined with the 93.66% EPSS score and confirmed active exploitation, this vulnerability demands immediate remediation for any exposed devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.