Security News > 2021 > August > Multiple Flaws Affecting Realtek Wi-Fi SDKs Impact Nearly a Million IoT Devices

Taiwanese chip designer Realtek is warning of four security vulnerabilities in three software development kits accompanying its WiFi modules, which are used in almost 200 IoT devices made by at least 65 vendors.

CVE-2021-35394 - Multiple buffer overflow vulnerabilities and an arbitrary command injection vulnerability in 'UDPServer' MP tool.

CVE-2021-35395 - Multiple buffer overflow vulnerabilities in HTTP web server 'boa' due to unsafe copies of some overly long parameters.

"We got 198 unique fingerprints for devices that answered over UPnP. If we estimate that each device may have sold 5k copies, the total count of affected devices would be close to a million," researchers said.

The security issues are said to have remained untouched in Realtek's codebase for more than a decade, German cybersecurity specialist IoT Inspector, which discovered the weaknesses, said in a report published Monday three months after disclosing them to Realtek in May 2021.

"On the product vendor's end, manufacturers with access to the Realtek source code missed to sufficiently validate their supply chain, [and] left the issues unspotted and distributed the vulnerabilities to hundreds of thousands of end customers - leaving them vulnerable to attacks," the researchers said.

News URL

http://feedproxy.google.com/~r/TheHackersNews/~3/wmWqVUXfGAA/multiple-flaws-affecting-realtek-wi-fi.html