CVE-2021-35394
RCE in Realtek Rtl819X Jungle Software Development Kit 2.0 – 3.4.14b
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2021-35394 is a critical-severity OS Command Injection (CWE-78) vulnerability in Realtek Rtl819X Jungle Software Development Kit. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique NTDS (T1003.003); ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Realtek Jungle SDK versions v2.x through v3.4.14B include a diagnostic component known as MP Daemon, typically built as the UDPServer binary, that contains multiple memory corruption issues along with an arbitrary command injection flaw tracked under CWE-78. The affected SDK is widely used in networking and IoT devices, and the vulnerabilities received a CVSS v3.1 score of 9.8.
Remote unauthenticated attackers can exploit the flaws over the network without any user interaction or credentials. Successful exploitation grants full control of the confidentiality, integrity, and availability of the device, enabling arbitrary command execution and potential memory corruption attacks that can lead to crashes or further code execution.
Public advisories referenced in the CVE entry, including reports from IoT Inspector and a security bulletin from Realtek, document the issues and point to vendor guidance for affected SDK versions. No information on observed in-the-wild exploitation is supplied in the source data.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-22037
Vulnerability Data
Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be…
more
exploited by remote unauthenticated attackers.
- CWE(s)
- KEV Date Added
- 10 December 2021
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.5V1.2.8
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-06's SDLC practices directly require secure coding and input handling that blocks command-injection defects, yet the single broad outcome leaves many specific neutralization vectors and verification gaps unaddressed.
Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.