CVE-2021-35394: Realtek Jungle SDK RCE Vulnerability

CVE-2021-35394 Overview

CVE-2021-35394 is a critical vulnerability affecting the Realtek Jungle SDK version v2.x up to v3.4.14B. The SDK provides a diagnostic tool called 'MP Daemon' that is typically compiled as the UDPServer binary. This binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers over the network.

This vulnerability is particularly concerning because the Realtek Jungle SDK is widely used in IoT devices, routers, and access points from numerous manufacturers, creating a significant supply chain risk across the embedded device ecosystem.

Critical Impact

Remote unauthenticated attackers can exploit memory corruption and command injection flaws in the UDPServer binary to achieve complete device compromise, including arbitrary code execution and full system control.

Affected Products

• Realtek RTL819x Jungle Software Development Kit v2.x through v3.4.14B
• IoT devices, routers, and access points utilizing the vulnerable SDK
• Embedded systems incorporating the MP Daemon/UDPServer diagnostic tool

Discovery Timeline

• August 16, 2021 - CVE-2021-35394 published to NVD
• November 7, 2025 - Last updated in NVD database

Technical Details for CVE-2021-35394

Vulnerability Analysis

The vulnerability resides in the MP Daemon diagnostic tool, which is typically compiled as the UDPServer binary within devices using the Realtek Jungle SDK. This diagnostic service listens for network requests and processes them without proper authentication or input validation.

The UDPServer binary contains multiple distinct vulnerability classes. First, it suffers from memory corruption issues where improper handling of user-supplied input leads to buffer overflow conditions that can corrupt adjacent memory regions. Second, and critically, the binary contains an arbitrary command injection vulnerability (CWE-78) where attacker-controlled input is passed directly to system command execution functions without proper sanitization.

Since the vulnerable service operates over UDP and requires no authentication, attackers on the same network segment—or potentially from the internet if the device is exposed—can send specially crafted packets to trigger these vulnerabilities. The combination of network accessibility, no authentication requirements, and multiple exploitation paths makes this vulnerability highly dangerous.

Root Cause

The root cause stems from insufficient input validation and improper neutralization of special elements used in OS commands (CWE-78). The UDPServer binary processes incoming UDP packets and uses portions of the packet data in system calls without sanitizing shell metacharacters or validating buffer boundaries.

Additionally, the diagnostic nature of the MP Daemon means it was likely designed for internal testing and development purposes, resulting in relaxed security controls that were inadvertently left enabled in production firmware builds distributed to device manufacturers.

Attack Vector

The attack is network-based and can be executed remotely without authentication. An attacker sends specially crafted UDP packets to the listening UDPServer service. The malicious payload can either:

1. Overflow memory buffers to corrupt program execution flow and achieve arbitrary code execution
2. Inject operating system commands through improperly sanitized input fields, which are then executed with the privileges of the UDPServer process (typically root)

The exploitation mechanism involves crafting UDP packets with malicious payloads targeting the diagnostic command interface. When the vulnerable service processes these packets, the injected commands are executed directly on the target system. For detailed technical analysis, refer to the IoT Inspector Security Advisory.

Detection Methods for CVE-2021-35394

Indicators of Compromise

• Unexpected outbound network connections from IoT devices or embedded systems
• Suspicious UDP traffic targeting diagnostic service ports on internal network devices
• Anomalous process execution spawned by the UDPServer binary or similar diagnostic services
• Evidence of command injection attempts in network packet captures (shell metacharacters in UDP payloads)
• Unauthorized firmware modifications or configuration changes on affected devices

Detection Strategies

• Monitor network traffic for unusual UDP communications to embedded devices, particularly targeting diagnostic service ports
• Implement network segmentation to isolate IoT and embedded devices from critical infrastructure
• Deploy intrusion detection signatures targeting known exploitation patterns for CVE-2021-35394
• Conduct firmware analysis on deployed devices to identify vulnerable Realtek SDK versions
• Review CISA KEV alerts and correlate with inventory of deployed embedded systems

Monitoring Recommendations

• Enable comprehensive logging on network boundaries to capture UDP traffic anomalies
• Implement behavioral monitoring for IoT device network activity baselines
• Configure alerts for devices initiating unexpected external connections
• Monitor for exploitation attempts using threat intelligence feeds that track CVE-2021-35394 activity

How to Mitigate CVE-2021-35394

Immediate Actions Required

• Identify all devices in your environment using the Realtek Jungle SDK by reviewing firmware manifests and vendor documentation
• Apply vendor-provided firmware updates that address CVE-2021-35394 immediately
• Isolate vulnerable devices on segmented network segments with restricted access
• Disable or block network access to the UDPServer diagnostic service if possible
• Review the CISA Known Exploited Vulnerabilities Catalog for additional guidance

Patch Information

Realtek has released updated SDK versions addressing these vulnerabilities. Device manufacturers using the Realtek Jungle SDK must obtain the patched SDK version and release updated firmware for their products. End users should contact their device vendors to determine firmware update availability.

Refer to the Realtek SDK Security Advisory for official vendor guidance and patch details.

Workarounds

• Disable the MP Daemon/UDPServer diagnostic service through device configuration if the option is available
• Implement strict network access controls to prevent untrusted hosts from reaching vulnerable devices
• Deploy network-based blocking rules for UDP traffic to diagnostic service ports on embedded devices
• Consider replacing end-of-life devices that will not receive vendor firmware updates

# Network isolation example using iptables (on gateway/firewall)
# Block external access to common diagnostic UDP ports on IoT subnet
iptables -A FORWARD -d 192.168.100.0/24 -p udp --dport 9034 -j DROP
iptables -A FORWARD -d 192.168.100.0/24 -p udp --dport 9035 -j DROP

# Log attempted connections for monitoring
iptables -A FORWARD -d 192.168.100.0/24 -p udp -j LOG --log-prefix "IoT-UDP-Blocked: "