CVE-2021-35395
9.8, critical Known exploitedRealtek AP-Router SDK Buffer Overflow Vulnerability
- CVSS
- 9.8, critical critical CVSS v3.1
- EPSS, next 30 days
- 98% higher than 99.9% of scored CVEs
- Exploitation
- Confirmed in the wild
- Published
- 16 Aug 20215 years ago
Known exploited
CISA added this to the Known Exploited Vulnerabilities Catalog on 3 Nov 2021. US federal agencies had to remediate by 17 Nov 2021, a deadline that has passed.
Required action. Apply updates per vendor instructions.
Description
Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface exists: one based on Go-Ahead named webs and another based on Boa named boa. Both of them are affected by these vulnerabilities. Specifically, these binaries are vulnerable to the following issues: - stack buffer overflow in formRebootCheck due to unsafe copy of submit-url parameter - stack buffer overflow in formWsc due to unsafe copy of submit-url parameter - stack buffer overflow in formWlanMultipleAP due to unsafe copy of submit-url parameter - stack buffer overflow in formWlSiteSurvey due to unsafe copy of ifname parameter - stack buffer overflow in formStaticDHCP due to unsafe copy of hostname parameter - stack buffer overflow in formWsc due to unsafe copy of 'peerPin' parameter - arbitrary command execution in formSysCmd via the sysCmd parameter - arbitrary command injection in formWsc via the 'peerPin' parameter Exploitability of identified issues will differ based on what the end vendor/manufacturer did with the Realtek SDK webserver. Some vendors use it as-is, others add their own authentication implementation, some kept all the features from the server, some remove some of them, some inserted their own set of features. However, given that Realtek SDK implementation is full of insecure calls and that developers tends to re-use those examples in their custom code, any binary based on Realtek SDK webserver will probably contains its own set of issues on top of the Realtek ones (if kept). Successful exploitation of these issues allows remote attackers to gain arbitrary code execution on the device.
Details
- Vendor
- Realtek
- Product
- Rtl819x Jungle Software Development Kit
- Weakness
- n/a
- Status
- Analyzed
- Updated
- 17 Jun 2026
- Assigner
- cve@mitre.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References 4
Exploit code 1
Patches and fixes 2
The kind is read from NVD's tags where present and from the shape of the URL otherwise, so treat it as a hint.
Other Realtek CVEs
Every Realtek CVE we holdSame vendor in what we hold, not a known link between the flaws.
- CVE-2021-35394 Realtek Jungle SDK Remote Code Execution Vulnerability KEV EPSS 100% 9.8, critical
- CVE-2014-8361 Realtek SDK Improper Input Validation Vulnerability KEV EPSS 100% 9.8, critical
Beyond this page
Is CVE-2021-35395 in your network?
This page tells you how dangerous CVE-2021-35395 is out there. Whether it sits on one of your devices, only a scan of your own network can tell. That is what our systems do, every day, for the companies we protect.
CVE-2021-35395 is in the CISA catalogue of exploited vulnerabilities: attackers are already exploiting it.
-
EXYS7600 OCELOT
Find it before attackers do
Ocelot scans your network on a schedule and reports every vulnerability it finds by its CVE identifier, with its CVSS score and how many of your hosts are affected. A finding like CVE-2021-35395 comes with the devices to patch.
Learn more about EXYS7600 OCELOT -
EXYS7950 KONDRA
Detect it if it's exploited
Until the patch is applied, Kondra monitors your network, events and endpoints in real time. It keeps an inventory of the software installed on every endpoint, and its anomaly detection rules flag what an attacker does once inside.
Learn more about EXYS7950 KONDRA
Assembled from the NVD 2.0 API, the CISA Known Exploited Vulnerabilities Catalog and FIRST EPSS. Scores are as of our last collection on 17 Oct 2026, not the live upstream state.