CVE-2021-35395: Realtek Jungle SDK RCE Vulnerability

CVE-2021-35395 Overview

CVE-2021-35395 is a critical vulnerability affecting the Realtek Jungle SDK version v2.x up to v3.4.14B, which provides an HTTP web server exposing a management interface used to configure network access points. The SDK includes two versions of this management interface—one based on Go-Ahead named webs and another based on Boa named boa—both of which are affected by multiple stack buffer overflow and command injection vulnerabilities. These vulnerabilities allow remote attackers to achieve arbitrary code execution on affected IoT devices without authentication.

Critical Impact

This vulnerability is actively exploited in the wild and listed in CISA's Known Exploited Vulnerabilities catalog. Successful exploitation allows remote attackers to gain complete control of affected IoT devices including routers, access points, and other embedded systems using the Realtek SDK.

Affected Products

• Realtek RTL819x Jungle Software Development Kit v2.x through v3.4.14B
• IoT devices, routers, and access points built using the Realtek Jungle SDK
• Devices utilizing the webs (Go-Ahead based) or boa web server components

Discovery Timeline

• 2021-08-16 - CVE CVE-2021-35395 published to NVD
• 2025-11-07 - Last updated in NVD database

Technical Details for CVE-2021-35395

Vulnerability Analysis

This vulnerability encompasses multiple distinct security issues within the Realtek Jungle SDK's web server components. The affected binaries contain several stack buffer overflow vulnerabilities caused by unsafe memory copy operations when handling HTTP form parameters. Additionally, the SDK includes command injection vulnerabilities that allow attackers to execute arbitrary system commands on the underlying device.

The exploitation complexity is notably low because the management interface is often accessible over the network without authentication. The supply chain impact is particularly severe—since Realtek provides this SDK to numerous IoT device manufacturers, the vulnerability propagates to potentially millions of deployed devices across various brands. Individual vendor implementations vary in security posture: some use the SDK components as-is, while others may add authentication layers or remove certain features. However, the fundamental insecure coding patterns in the SDK often persist or are replicated in vendor-specific code.

Root Cause

The root cause stems from multiple instances of unsafe memory handling in the web server's form processing functions. The SDK developers used unbounded copy operations (likely strcpy or sprintf) when handling user-supplied parameters such as submit-url, ifname, hostname, and peerPin. Without proper bounds checking, attackers can overflow stack buffers by providing overly long input values.

Additionally, the formSysCmd function directly passes the sysCmd parameter to system command execution without sanitization, enabling arbitrary command execution. The formWsc function's handling of the peerPin parameter contains a similar command injection flaw where attacker-controlled data reaches system command execution.

Attack Vector

The attack vector is network-based, targeting the HTTP management interface exposed by affected devices. Attackers can exploit these vulnerabilities by sending specially crafted HTTP POST requests to vulnerable form handlers. The specific vulnerable endpoints include:

• formRebootCheck - Stack overflow via submit-url parameter
• formWsc - Stack overflow via submit-url and command injection via peerPin parameter
• formWlanMultipleAP - Stack overflow via submit-url parameter
• formWlSiteSurvey - Stack overflow via ifname parameter
• formStaticDHCP - Stack overflow via hostname parameter
• formSysCmd - Direct arbitrary command execution via sysCmd parameter

For the command injection vulnerabilities, an attacker can inject shell metacharacters to execute arbitrary commands with the privileges of the web server process (typically root on embedded devices). For the buffer overflow vulnerabilities, exploitation typically involves overwriting the return address on the stack to redirect execution to attacker-controlled shellcode.

Detection Methods for CVE-2021-35395

Indicators of Compromise

• Unexpected HTTP POST requests to /goform/formSysCmd, /goform/formWsc, or other vulnerable endpoints
• Network traffic containing shell metacharacters or unusually long parameter values in HTTP requests to IoT device management interfaces
• Unusual outbound connections from IoT devices to unknown IP addresses
• Modified firmware or configuration files on affected devices
• Presence of unauthorized backdoor accounts or SSH keys on compromised devices

Detection Strategies

• Deploy network intrusion detection rules to identify exploitation attempts targeting Realtek SDK management endpoints
• Monitor HTTP traffic for POST requests containing suspicious patterns in sysCmd, peerPin, submit-url, hostname, or ifname parameters
• Implement web application firewall rules to block requests with command injection payloads or excessively long parameter values
• Conduct firmware analysis to identify devices running vulnerable Realtek SDK versions

Monitoring Recommendations

• Enable logging on network edge devices to capture traffic to and from IoT device management interfaces
• Implement network segmentation to isolate IoT devices and monitor inter-segment traffic for anomalies
• Deploy behavioral analysis solutions to detect unusual activity patterns from IoT devices
• Regularly audit network inventory to identify devices running affected Realtek SDK versions

How to Mitigate CVE-2021-35395

Immediate Actions Required

• Immediately disable remote access to the web management interface on affected devices where possible
• Implement network segmentation to prevent direct access to IoT device management interfaces from untrusted networks
• Apply vendor-provided firmware updates that address CVE-2021-35395
• Deploy network-level access controls to restrict management interface access to authorized administrators only
• Consider replacing devices from manufacturers who have not released patches

Patch Information

Realtek has released a security advisory addressing CVE-2021-35395. Device manufacturers using the Realtek Jungle SDK should apply the patched SDK version and release updated firmware to their customers. End users should check with their device manufacturers for firmware updates and apply them promptly. The Realtek SDK Advisory PDF provides official vendor guidance, and additional technical details are available from IoT Inspector's advisory. CISA has cataloged this as a known exploited vulnerability—refer to the CISA KEV catalog for remediation deadlines.

Workarounds

• Disable the HTTP management interface entirely if remote administration is not required
• Implement firewall rules to block external access to ports 80 and 443 on affected devices
• Use VPN or other secure access methods to reach device management interfaces when remote access is necessary
• Configure upstream network devices to filter HTTP requests containing known malicious patterns

# Example: Block external access to IoT management interface using iptables
# Apply on network gateway or directly on device if supported
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 192.168.1.0/24 -j DROP