{"id":"CVE-2021-35395","published":"2021-08-16T12:15:07Z","modified":"2026-06-17T03:57:29Z","title":"Realtek AP-Router SDK Buffer Overflow Vulnerability","vendor":"Realtek","product":"AP-Router SDK","tier":"core","eol":null,"description":{"text":"Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface exists: one based on Go-Ahead named webs and another based on Boa named boa. Both of them are affected by these vulnerabilities. Specifically, these binaries are vulnerable to the following issues: - stack buffer overflow in formRebootCheck due to unsafe copy of submit-url parameter - stack buffer overflow in formWsc due to unsafe copy of submit-url parameter - stack buffer overflow in formWlanMultipleAP due to unsafe copy of submit-url parameter - stack buffer overflow in formWlSiteSurvey due to unsafe copy of ifname parameter - stack buffer overflow in formStaticDHCP due to unsafe copy of hostname parameter - stack buffer overflow in formWsc due to unsafe copy of 'peerPin' parameter - arbitrary command execution in formSysCmd via the sysCmd parameter - arbitrary command injection in formWsc via the 'peerPin' parameter Exploitability of identified issues will differ based on what the end vendor/manufacturer did with the Realtek SDK webserver. Some vendors use it as-is, others add their own authentication implementation, some kept all the features from the server, some remove some of them, some inserted their own set of features. However, given that Realtek SDK implementation is full of insecure calls and that developers tends to re-use those examples in their custom code, any binary based on Realtek SDK webserver will probably contains its own set of issues on top of the Realtek ones (if kept). Successful exploitation of these issues allows remote attackers to gain arbitrary code execution on the device.","provenance":"source","from":"NVD"},"summary":{"text":"Realtek Jungle SDK versions v2.x through v3.4.14B contain multiple stack buffer overflows and command injection flaws in the web management interface of AP-Router SDK, in both its Go-Ahead \"webs\" and Boa \"boa\" server variants. An attacker with network access to the management interface, requiring no authentication or user interaction, can trigger these issues through crafted requests to specific form handlers (such as formSysCmd, formWsc, and formStaticDHCP) to execute arbitrary code on the device, though exploitability depends on how each vendor deployed the SDK server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:43:56Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.981,"percentile":0.99911,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-35395","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-08-24","exploitedFirstSeen":"2021-08-24","ransomware":false,"evidence":[{"url":"https://www.radware.com/getmedia/18d24c2d-c092-4a61-9ad6-ebb92b7a49b8/Alert_Realtek_SDK.aspx","date":"2021-08-24"},{"url":"https://blogs.juniper.net/en-us/threat-research/attacks-continue-against-realtek-vulnerabilities","date":"2021-09-02"},{"url":"https://twitter.com/ESETresearch/status/1440052837820428298?s=20","date":"2021-09-20"},{"url":"https://www.radware.com/getmedia/d312a5fa-2d8d-4c1e-b31e-73046f24bf35/Alert-Dark-OMIGOD.aspx","date":"2021-09-20"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://cujo.com/blog/iot-botnet-report-2021-malware-and-vulnerabilities-targeted/","date":"2021-12-17"},{"url":"https://unit42.paloaltonetworks.com/network-attacks-trends-august-october-2021/","date":"2021-12-21"},{"url":"https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities","date":"2022-12-06"},{"url":"https://blog.netlab.360.com/new-ddos-botnet-wszeor/","date":"2022-12-07"},{"url":"https://t.me/hacking_Attack/79492","date":"2022-12-08"}],"evidenceTotal":743,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"},{"id":"CWE-122","name":"Heap-based Buffer Overflow"}],"references":[{"url":"https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain","tags":["Broken Link","Exploit","Third Party Advisory"]},{"url":"https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf","tags":["Patch"]},{"url":"https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain","tags":["Broken Link","Exploit","Third Party Advisory"]},{"url":"https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf","tags":["Patch"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35395","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote exploit of public-facing web management interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"HTTP web server exposing a management interface that can be used to configure the access point","start":59,"end":153}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary command execution via formSysCmd","mappingType":"primary_impact","evidence":[{"from":"description","quote":"arbitrary command execution in formSysCmd via the sysCmd parameter","start":893,"end":959}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Stack buffer overflows enable code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"stack buffer overflow in formRebootCheck due to unsafe copy of submit-url parameter","start":397,"end":480}],"model":"claude-haiku-5-5","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"}],"reports":[{"id":"SRC-b3ea000916d84bc1c41a","title":"Microsoft research uncovers new Zerobot capabilities","publisher":"microsoft.com","url":"http://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/","date":null,"mentions":[{"quote":"CVE-2021-35395","start":12105,"end":12119}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-22038","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-22038","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2021-35395","name":"RealTek Jungle SDK - Arbitrary Command Injection","severity":"critical","path":"http/cves/2021/CVE-2021-35395.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35395.yaml"}],"provenance":"source"},"exploitRefs":["https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1203"],"provenance":"ai","lowConfidence":true}],"timeline":[{"date":"2021-08-16","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35395","provenance":"source"},{"date":"2021-08-24","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.radware.com/getmedia/18d24c2d-c092-4a61-9ad6-ebb92b7a49b8/Alert_Realtek_SDK.aspx","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-22038","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":79},"priority":{"score":73.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1894 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9991"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}