CVE DatabaseCVE-2021-35394

Updated 2026-06-17한국어 권고문 →

CVE-2021-353949.8/CRITICALCISA KEVCWE-78

Realtek Jungle SDK MP Daemon (UDPServer) Remote Code Execution and Command Injection Vulnerability (CVE-2021-35394) Analysis & Mitigation Guide

⚡ Jump to Patch

Affected Vendors

realtek

Affected Components

jungle_sdk, mp_daemon, udpserver

Published Date

2021-08-16

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

99.9%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Embedded IoT devices utilizing Realtek Jungle SDK versions v2.x through v3.4.14B containing the 'MP Daemon' (UDPServer) diagnostic tool

Impact

Unauthenticated remote attackers can execute arbitrary system commands with root privileges or trigger memory corruption on the target device

Mitigation

Apply the official vendor firmware patch, disable the UDPServer service, or restrict external access to the diagnostic UDP ports using firewall rules

Affected Products & Version Scope

Routers, access points, IP cameras, and other embedded IoT devices running Realtek Jungle SDK v2.x through v3.4.14B with the UDPServer binary active

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the latest firmware updates provided by your device manufacturer (OEM/ODM). If you are building the SDK from source, ensure that the input validation patches are applied to the MP Daemon source code, or disable the component entirely if not required for production.

bash

# Disable the vulnerable MP Daemon configuration in the SDK build config
sed -i 's/CONFIG_RTL_BOARD_MP=y/CONFIG_RTL_BOARD_MP=n/g' .config
make dep && make clean && make

2. Temporary Workaround & Hardening Configuration

If firmware updates cannot be immediately applied, use iptables to block external access to the diagnostic port.

bash

# Block incoming traffic to the default UDPServer port (e.g., UDP 9034)
iptables -A INPUT -p udp --dport 9034 -j DROP

# Restrict access to local loopback interface only
iptables -A INPUT ! -i lo -p udp --dport 9034 -j DROP

3. Log Audit & IoC Verification Commands

Run the following script on the target device to check if the vulnerable UDPServer binary is running and listening on network ports.

bash

#!/bin/sh
echo '[+] Scanning for active UDPServer processes...'
ps_out=$(ps | grep -E 'UDPServer|mp_daemon' | grep -v grep)
if [ ! -z '$ps_out' ]; then
  echo '[WARNING] Vulnerable UDPServer process is running!'
  echo '$ps_out'
else
  echo '[OK] UDPServer process is not running.'
fi

echo '[+] Checking active network listeners...'
netstat -anup | grep -E '9034|UDPServer'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active exploitation in the wild, immediately block external access to UDP port 9034 and upgrade to a patched firmware version.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability exists in the 'MP Daemon' diagnostic tool (typically compiled as the 'UDPServer' binary) bundled with the Realtek Jungle SDK (versions v2.x to v3.4.14B). Designed for production testing and network diagnostics, the binary fails to properly validate and sanitize incoming UDP packet payloads before processing them. This lack of input validation allows shell metacharacters to be passed directly to system command execution functions (such as system()), resulting in arbitrary command injection (CWE-78) and multiple memory corruption issues.

2. Exploitation Mechanics & Attack Scenario

An attacker exploits this vulnerability by sending crafted UDP packets to the port where UDPServer is listening (commonly UDP port 9034). Because the binary parses arguments without verifying buffer boundaries or filtering command delimiters (such as ;, `, or |), the injected payload is executed in the context of the root user. This mechanism is highly automated and actively leveraged by IoT botnets like Mirai and Gafgyt to download and execute malicious shell scripts.

3. Infrastructure & Business Impact

Given its inclusion in the CISA KEV catalog and an EPSS score of over 99%, this vulnerability is a prime target for automated threat actors. Successful exploitation grants complete administrative control over the compromised router, gateway, or IP camera. This can lead to unauthorized lateral movement within the enterprise network, data exfiltration, or enlistment of the device into DDoS botnets, causing severe operational disruption and reputational damage.

Official Vendor Advisories & References

NVD Original English Description

Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.

https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain

Source: cve@mitre.org · Broken Link, Exploit, Third Party Advisory

https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en

Source: cve@mitre.org · Broken Link, Patch, Vendor Advisory

https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf

Source: cve@mitre.org · Patch, Vendor Advisory

https://www.securityfocus.com/archive/1/534765

Source: cve@mitre.org · Broken Link, Third Party Advisory, VDB Entry

https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain

Source: af854a3a-2127-422b-91ae-364da2661108 · Broken Link, Exploit, Third Party Advisory

https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en

Source: af854a3a-2127-422b-91ae-364da2661108 · Broken Link, Patch, Vendor Advisory

Frequently Asked SecOps Questions (CVE-2021-35394)

FAQ

Q1. How critical is CVE-2021-35394 and is it actively exploited in the wild?

CVE-2021-35394 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2021-35394?

Primary impacted vendors include realtek across jungle_sdk, mp_daemon, udpserver. Scope summary: Routers, access points, IP cameras, and other embedded IoT devices running Realtek Jungle SDK v2.x through v3.4.14B with the UDPServer binary active

Q3. What temporary mitigations or workarounds exist for CVE-2021-35394 before patching?

[Mitigation] Apply the official vendor firmware patch, disable the UDPServer service, or restrict external access to the diagnostic UDP ports using firewall rules Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION