Heap-based buffer overflow in Realtek products - CVE-2021-35393

Vulnerability identifier: #VU55912

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-35393

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to unsafe parsing of the UPnP SUBSCRIBE/UNSUBSCRIBE Callback header. A remote attacker can pass specially crafted data to the application, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Realtek SDK
Realtek Luna SDK
Realtek Jungle SDK
MR-GM2
MR-GM3-D
MR-GM3-K
MR-GM3-M
MR-GM3-S
MR-GM3-W
MR-GM3-DK
MR-GM3-DKS

Install updates from vendor's website.

Realtek Luna SDK - update to 1.3.2a
MR-GM2 - update to 3.01.00
MR-GM3-D - update to 1.04.00
MR-GM3-K - update to 1.04.00
MR-GM3-M - update to 1.04.00
MR-GM3-S - update to 1.04.00
MR-GM3-W - update to 1.04.00
MR-GM3-DK - update to 1.04.00
MR-GM3-DKS - update to 1.04.00

• https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en
• https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain
• https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf

• Multiple vulnerabilities in Realtek SDK
• Multiple vulnerabilities in Micro Research MR-GM series