Vulnerabilities > CVE-2021-35392 - Out-of-bounds Write vulnerability in Realtek Jungle SDK

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
realtek
CWE-787
NVD
Published: 2021-08-16
Updated: 2024-11-21

Summary

Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or mini_upnpd and is the successor to miniigd. The server is vulnerable to a heap buffer overflow that is present due to unsafe crafting of SSDP NOTIFY messages from received M-SEARCH messages ST header.

Vulnerable Configurations

Part Description Count
Application
Realtek
1

Common Weakness Enumeration (CWE)

References