CVE-2021-35394

Name of the Vulnerable Software and Affected Versions Realtek Jungle SDK versions v2.x through v3.4.14B

Description The diagnostic tool known as MP Daemon, typically compiled as the UDPServer binary, contains multiple memory corruption issues, including buffer overflows, and an arbitrary command injection flaw. These flaws allow remote unauthenticated attackers to execute arbitrary code and gain full control over affected devices. The issue has been exploited in large-scale attacks targeting IoT devices such as routers, IP cameras, and Wi-Fi repeaters from numerous manufacturers. One notable incident involves the Cling botnet, which exploits this flaw by sending UDP datagrams starting with orf; followed by shell commands to download and execute malicious payloads. The botnet further maintains persistence by replacing the wget binary and masks its command-and-control traffic as STUN (Session Traversal Utilities for NAT) messages. It is estimated that approximately one million devices were initially targeted, with later observations recording over 134 million exploitation attempts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.