CVE-2021-35394

Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

99.88% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2021-12-10

Nuclei

critical

Published

2021-08-16

Updated

2025-10-21

Proof-of-concept exploits (1)

• https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/javascript/cves/2021/CVE-2021-35394.yaml

Security advisories

• https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en
• https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_3…
• https://www.securityfocus.com/archive/1/534765

References

• CVE Record
• NVD entry