Realtek SDK Vulnerability Attacks Highlight IoT Supply Chain Threats
Summary: Unit 42 recorded 134 million exploit attempts against the Realtek Jungle SDK remote code execution vulnerability CVE-2021-35394 between August 2021 and December 2022, with about 97% occurring after the start of August 2022 and attacks still ongoing at the time of writing. The flaw, disclosed August 16, 2021, affects UDPServer in Realtek Jungle SDK version 2.0 through 3.4.14B and touches almost 190 device models from 66 manufacturers, with payloads mostly from Mirai, Gafgyt and Mozi plus a new Golang DDoS botnet called RedGoBot.
Why it matters: Between August and October 2022 this single vulnerability accounted for more than 40% of all attacks Unit 42 observed, against a typical monthly ceiling of 10% for any one flaw, and the chipset inside an affected device often cannot be identified from its exterior.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-35394
- Related
- CVE-2021-35394: Realtek Jungle SDK Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 10, 2021Network Security Trends: August-October 2022 Cyber Risks ·