CVE-2014-8361
Realtek SDK Improper Input Validation Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 9 October 2023). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 99.98% probability · 100th percentile
- CISA KEV
- Listed 18 September 2023 · due 9 October 2023
- Affected
- dlink/dir-905l firmware · dlink/dir-605l firmware · dlink/dir-600l firmware · dlink/dir-619l firmware · dlink/dir-809 firmware · dlink/dir-900l firmware · realtek/realtek sdk · dlink/dir-501 firmware · dlink/dir-515 firmware · dlink/dir-615 firmware · aterm/wg1900hp2 firmware · aterm/wg1900hp firmware · aterm/wg1800hp4 firmware · aterm/wg1800hp3 firmware · aterm/wg1200hs2 firmware · aterm/wg1200hp3 firmware · aterm/wg1200hp2 firmware · aterm/w1200ex firmware · aterm/w1200ex-ms firmware · aterm/wg1200hs firmware · +6 more
- Source
- cve@mitre.org
CISA notes
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://web.archive.org/web/20150831100501/http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055; https://nvd.nist.gov/vuln/detail/CVE-2014-8361
References
- http://jvn.jp/en/jp/JVN47580234/index.htmlThird Party Advisory
- http://jvn.jp/en/jp/JVN67456944/index.htmlThird Party Advisory
- http://packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-Command-Execution.htmlThird Party Advisory, VDB Entry
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055Vendor Advisory
- http://www.securityfocus.com/bid/74330Broken Link, Third Party Advisory, VDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-15-155/Third Party Advisory, VDB Entry
- https://sensorstechforum.com/hinatabot-cve-2014-8361-ddos/Third Party Advisory
- https://web.archive.org/web/20150909230440/http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055Third Party Advisory
- https://www.exploit-db.com/exploits/37169/Third Party Advisory, VDB Entry
- http://jvn.jp/en/jp/JVN47580234/index.htmlThird Party Advisory
- http://jvn.jp/en/jp/JVN67456944/index.htmlThird Party Advisory
- http://packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-Command-Execution.htmlThird Party Advisory, VDB Entry
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055Vendor Advisory
- http://www.securityfocus.com/bid/74330Broken Link, Third Party Advisory, VDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-15-155/Third Party Advisory, VDB Entry
- https://sensorstechforum.com/hinatabot-cve-2014-8361-ddos/Third Party Advisory
- https://web.archive.org/web/20150909230440/http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055Third Party Advisory
- https://www.exploit-db.com/exploits/37169/Third Party Advisory, VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-8361US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.