15 vulnerabilities discovered in software development kit for wireless routers

Summary: Cisco Talos discovered 15 vulnerabilities in the Realtek rtl819x Jungle software development kit used in small and home office wireless routers, which uses the discontinued open-source Boa as its web server. The issues include stack-based buffer overflows from crafted HTTP requests, a heap-based buffer overflow via a crafted .dat file (CVE-2024-21778), cross-site request forgery (CVE-2023-47677), and a firmware update flaw (CVE-2023-34435); Realtek patched the SDK, while LevelOne declined to fix two related flaws in its WBR-6013 router, including a hardcoded telnetd password (CVE-2023-46685).
What you should know: LevelOne has declined to release a patch for the WBR-6013, leaving a hardcoded telnetd password and a reachable Boa command API in a router that sits inside home and small-office networks.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-34435 CVE-2023-45742 CVE-2023-46685 CVE-2023-47677 CVE-2023-49593 CVE-2023-50381 CVE-2023-50382 CVE-2023-50383 CVE-2024-21778 CVE-2024-32937
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026