Realtek AP-Router SDK Buffer Overflow

What to do

1. Check which version of Rtl819x Jungle Software Development Kit you run against the affected versions below, and install the vendor's latest release.
2. CISA's required action: Apply updates per vendor instructions.
3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

Version data comes from NVD's product matching. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector

NetworkCan be exploited remotely over a network, including the internet.

Attack complexity

LowNo special conditions are needed; the attack works reliably.

Privileges required

NoneNo account or login is needed.

User interaction

NoneNo action by a victim is required.

Scope

UnchangedImpact stays within the vulnerable component.

Confidentiality

HighAll data handled by the component can be read.

Integrity

HighData or code can be modified at will.

Availability

HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface exists: one based on Go-Ahead named webs and another based on Boa named boa. Both of them are affected by these vulnerabilities. Specifically, these binaries are vulnerable to the following issues: - stack buffer overflow in formRebootCheck due to unsafe copy of submit-url parameter - stack buffer overflow in formWsc due to unsafe copy of submit-url parameter - stack buffer overflow in formWlanMultipleAP due to unsafe copy of submit-url parameter - stack buffer overflow in formWlSiteSurvey due to unsafe copy of ifname parameter - stack buffer overflow in formStaticDHCP due to unsafe copy of hostname parameter - stack buffer overflow in formWsc due to unsafe copy of 'peerPin' parameter - arbitrary command execution in formSysCmd via the sysCmd parameter - arbitrary command injection in formWsc via the 'peerPin' parameter Exploitability of identified issues will differ based on what the end vendor/manufacturer did with the Realtek SDK webserver. Some vendors use it as-is, others add their own authentication implementation, some kept all the features from the server, some remove some of them, some inserted their own set of features. However, given that Realtek SDK implementation is full of insecure calls and that developers tends to re-use those examples in their custom code, any binary based on Realtek SDK webserver will probably contains its own set of issues on top of the Realtek ones (if kept). Successful exploitation of these issues allows remote attackers to gain arbitrary code execution on the device.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

Timeline

1. August 16, 2021CVE record published.
2. November 3, 2021Added to CISA's Known Exploited Vulnerabilities catalogue.
3. November 17, 2021Deadline for US federal agencies to remediate, set by CISA.
4. February 4, 2025CISA published its SSVC assessment (exploitation: active, automatable: yes, technical impact: total).
5. June 17, 2026Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Rtl819x Jungle Software Development Kit

• 7.2 High severity

  WBR-6013: Out-of-bounds Write

  CVE-2024-21778Jul 8, 2024LevelOne
• 7.2 High severity

  WBR-6013: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-50383Jul 8, 2024LevelOneEPSS 1.93%
• 7.2 High severity

  WBR-6013: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-50382Jul 8, 2024LevelOneEPSS 1.93%
• 7.2 High severity

  WBR-6013: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-50381Jul 8, 2024LevelOneEPSS 3.19%
• 7.2 High severity

  WBR-6013: Out-of-bounds Write

  CVE-2023-50330Jul 8, 2024LevelOneEPSS 1.1%
• 7.2 High severity

  WBR-6013: Out-of-bounds Write

  CVE-2023-50244Jul 8, 2024LevelOneEPSS 1.41%

Spotted an error? Tell us.