CVE-2021-35394
Published Aug 16, 2021
Last updated a year ago
- Description
- Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.
- Source
- cve@mitre.org
- NVD status
- Analyzed
- Products
- rtl819x_jungle_software_development_kit
CVSS 3.1
- Type
- Primary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
CVSS 2.0
- Type
- Primary
- Base score
- 10
- Impact score
- 10
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:C/I:C/A:C
Data from CISA
- Vulnerability name
- Realtek Jungle SDK Remote Code Execution Vulnerability
- Exploit added on
- Dec 10, 2021
- Exploit action due
- Dec 24, 2021
- Required action
- Apply updates per vendor instructions.
- nvd@nist.gov
- NVD-CWE-Other
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
- CWE-78
- Hype score
- Not currently trending
Cling, an IoT botnet, is exploiting exposed networking gear and hiding commands inside manipulated Google STUN traffic, per Nozomi Networks. The botnet abuses CVE-2021-35394 in the Realtek Jungle SDK diagnostic component, with propagation code also carrying exploits for flaws ht
@LandscapeThreat
10 Oct 2026
82 Impressions
0 Retweets
5 Likes
0 Bookmarks
0 Replies
0 Quotes
Cling botnet disguises C2 inside STUN protocol traffic and spoofs Google's STUN service to hide commands, exploiting CVE-2021-35394 and six other IoT flaws to spread and launch DDoS attacks. Key findings: - Cling exploits CVE-2021-35394, an RCE in the Realtek Jungle SDK https:/
@DFIR_Radar
6 Oct 2026
354 Impressions
0 Retweets
3 Likes
2 Bookmarks
2 Replies
0 Quotes
Cling botnet exploits CVE-2021-35394 (CVSS 9.8) in Realtek Jungle SDK, abusing public STUN infrastructure to disguise C2 traffic as legitimate NAT-traversal activity across routers, DVRs, and embedded Linux devices. Key details: - Exploitation of CVE-2021-35394 spiked around ht
@DFIR_Radar
5 Oct 2026
172 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
Cling is turning STUN into an IoT botnet command-and-control channel. A report says the malware exploits CVE-2021-35394, with additional command-injection flaws targeting exposed routers, DVRs and other devices: CVE-2016-20016, CVE-2023-41011, CVE-2016-10372, CVE-2025-34037, htt
@LandscapeThreat
5 Oct 2026
52 Impressions
1 Retweet
3 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:realtek:rtl819x_jungle_software_development_kit:*:*:*:*:*:*:*:*",
"matchCriteriaId": "00E83926-7610-44FA-9837-B03D386A07D5",
"versionEndIncluding": "3.4.14b",
"versionStartIncluding": "2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]