Realtek SDK Improper Input Validation

What to do

1. Update Dir-900l Firmware to 1.15b01 or a later version.
2. CISA's required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
3. Read the advisory on securityadvisories.dlink.com for workarounds and exact fixed builds.
4. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

Version data comes from NVD's product matching; 1 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector

NetworkCan be exploited remotely over a network, including the internet.

Attack complexity

LowNo special conditions are needed; the attack works reliably.

Privileges required

NoneNo account or login is needed.

User interaction

NoneNo action by a victim is required.

Scope

UnchangedImpact stays within the vulnerable component.

Confidentiality

HighAll data handled by the component can be read.

Integrity

HighData or code can be modified at will.

Availability

HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

Timeline

1. May 1, 2015CVE record published.
2. September 18, 2023Added to CISA's Known Exploited Vulnerabilities catalogue.
3. October 9, 2023Deadline for US federal agencies to remediate, set by CISA.
4. February 7, 2025CISA published its SSVC assessment (exploitation: active, automatable: yes, technical impact: total).
5. June 17, 2026Record last changed materially (score, affected products, status or references).

References

Spotted an error? Tell us.