Stack-based buffer overflow in Realtek products - CVE-2021-35392

Vulnerability identifier: #VU55911

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-35392

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to unsafe crafting of SSDP NOTIFY messages from received M-SEARCH messages ST header. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Realtek SDK
Realtek Luna SDK
Realtek Jungle SDK
MR-GM2
MR-GM3-D
MR-GM3-K
MR-GM3-M
MR-GM3-S
MR-GM3-W
MR-GM3-DK
MR-GM3-DKS

Install updates from vendor's website.

Realtek Luna SDK - update to 1.3.2a
MR-GM2 - update to 3.01.00
MR-GM3-D - update to 1.04.00
MR-GM3-K - update to 1.04.00
MR-GM3-M - update to 1.04.00
MR-GM3-S - update to 1.04.00
MR-GM3-W - update to 1.04.00
MR-GM3-DK - update to 1.04.00
MR-GM3-DKS - update to 1.04.00

• https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en
• https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain
• https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf

• Multiple vulnerabilities in Realtek SDK
• Multiple vulnerabilities in Micro Research MR-GM series