FortiGuard Labs has observed threat actors continuing to exploit an arbitrary command injection vulnerability in Realtek Jungle SDK (CVE-2021-35394). Successful exploitation of this vulnerability allows a remote attacker to execute arbitrary code on vulnerable devices, leading to system compromise. Realtek Jungle SDK based IoT devices are available from multiple vendors.Why is this Significant?This is significant because FortiGuard Labs is still detecting high counts (upwards of 6,000 devices per day) of CVE-2021-35394 being exploited in the wild even after a patch was released in August 2021. As such, it is recommended that the patch is applied as soon as possible when possible. CISA added CVE-2021-35394 to the Known Exploited Vulnerability (KEV) Catalog on December 10th, 2021.What is CVE-2021-35394?CVE-2021-35394 is an arbitrary command injection vulnerability that affects UDPServer in Realtek Jungle SDK version v2.0 up to v3.4.14B. Threat actors can leverage the vulnerability to execute arbitrary code on vulnerable devices, leading to system compromise. The vulnerability has a CVSS base score of 9.8.Malware such as RedGoBot, GooberBot, Mirai, Gafgyt and Mozi are reportedly associated with CVE-2021-35394.Has the Vendor Released an Advisory?Yes, Realtek released an advisory on August 15th, 2021. See the Appendix for a link to “Realtek AP-Router SDK Advisory (CVE-2021-35392/CVE-2021-35393/CVE-2021-35394/CVE-2021-35395)”.Has the Vendor Released a Patch for CVE-2021-35394?Yes, a patch from Realtek is available, however IoT device manufactures need to distribute the patch to their end products.What is the Status of Protection?FortiGuard Labs has the following IPS signature in place for CVE-2021-35394:Realtek.SDK.UDPServer.Command.Execution

Read More