CVE-2021-35394

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2021-35394 9.8

Realtek · Jungle Software Development Kit (SDK) · Added 2021-12-10 · Published 2021-08-16

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityRealtek Jungle SDK Remote Code Execution Vulnerability

VendorRealtek

ProductJungle Software Development Kit (SDK)

Date added2021-12-10

Due date2021-12-24

CISA catalogView on CISA KEV catalog

Required actionApply updates per vendor instructions.

CWECWE-78

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.

NVD: Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-16 21:45 UTC

Wall time0.3s

Searches2

Component defaultunknown

Sources https://nvd.nist.gov/vuln/detail/CVE-2021-35394
https://www.onekey.com/resource/advisory-multiple-issues-realtek-sdk-iot-supply-chain
https://www.extrahop.com/resources/detections/cve-2021-35394-realtek-sdk-exploit-attempt
https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2021/CVE-2021-35394.yaml
https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf
https://unit42.paloaltonetworks.com/realtek-sdk-vulnerability/
https://hackaday.com/2023/02/03/this-week-in-security-github-google-and-realtek/
https://community.hpe.com/t5/hpe-threat-labs/realtek-cve-2021-35394-exploited-in-the-wild/ba-p/7265981
https://www.sentinelone.com/vulnerability-database/cve-2021-35394/

Hunting hypothesis agent

Hunt network IDS/Zeek for lone UDP datagrams to port 9034 whose ASCII payload starts "orf;" — the MP Daemon passes the suffix to system() as root; botnets append busybox/wget stagers after the prefix.

Research details

ComponentMP Daemon diagnostic tool (compiled as UDPServer binary)

PreconditionsNetwork reachability to UDP port 9034 (default MP Daemon/UDPServer port) on a device running Realtek Jungle SDK v2.x through v3.4.14B; The MP Daemon diagnostic tool (UDPServer) must be running and exposed; An attacker sends a specially crafted UDP datagram with payload starting with 'orf;' followed by arbitrary OS commands; The tool does not validate the request and executes the injected commands via system() with root privileges; No authentication required; Command output is sent back via UDP agent

DeliveryA single unauthenticated UDP datagram to port 9034 whose ASCII payload starts with the 'orf;' prefix — everything after the prefix is passed to system() and executed as root; in-the-wild botnets append busybox/wget stagers to the same prefix.

Public PoCyes

PoC URLs https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2021/CVE-2021-35394.yaml
https://www.onekey.com/resource/advisory-multiple-issues-realtek-sdk-iot-supply-chain Third-party repos; verify before use.

Advisoryhttps://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | Exploitation is trivial: send UDP datagram with 'orf;' prefix followed by commands to port 9034; The flawed fix was to require 'orf' prefix, trivially bypassed with 'orf;' | The public projectdiscovery Nuclei JS template is functional verification: it sends orf;nslookup <OAST> to UDP 9034 and matches the DNS callback; HPE/Unit42 telemetry saw Mirai-style stagers using the same prefix.

SummaryCVE-2021-35394 is a command injection vulnerability in the MP Daemon diagnostic tool (compiled as UDPServer binary) in Realtek Jungle SDK v2.x through v3.4.14B. The UDPServer listens on UDP port 9034 and executes received commands via system(). An unauthenticated attacker can inject arbitrary OS commands by sending a UDP datagram with 'orf;' prefix, achieving full remote code execution on IoT devices (routers, IP cameras, Wi-Fi repeaters) using Realtek chipsets. This was exploited in large-scale botnet campaigns targeting IoT devices.

Tia coverage

First reported2021-08-16

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

linux-backdoor-abuses-stun-protocol-exploits-dozens-of-flaws

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.