Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

Summary: Nozomi Networks reported a spike in attempts to exploit CVE-2021-35394, a critical remote code execution flaw in the Realtek Jungle SDK (CVSS 9.8), starting around September 5, 2026, with some activity delivering a botnet called Cling. Cling hides its command-and-control in STUN traffic, sending registration messages to 13 servers and receiving operator commands embedded in the transaction ID field, with one server at 145.249.115[.]184 returning an all-zero transaction ID and command packets originating from 74.125.250[.]129, an address stun.l.google.com resolves to.
Bottom line: The operator makes commands look like replies from Google's public STUN service, so the traffic blends with normal VoIP and WebRTC and can pass network monitoring unnoticed. Cling also hard-codes exploits for seven vulnerabilities and spreads worm-like, so every unpatched internet-facing router or DVR is a potential recruit.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-35394
Related: CVE-2021-35394: Realtek Jungle SDK Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 10, 2021
Realtek SDK Vulnerability Attacks Highlight IoT Supply Chain Threats Cyber Risks ·
Network Security Trends: August-October 2022 Cyber Risks ·