{"id":101033,"date":"2021-08-18T10:22:37","date_gmt":"2021-08-18T08:22:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-realtek-sdk-priveli-k-problemam-v-ustrojstvah-65-proizvoditelej"},"modified":"2021-08-18T10:22:37","modified_gmt":"2021-08-18T08:22:37","slug":"uyazvimosti-v-realtek-sdk-priveli-k-problemam-v-ustrojstvah-65-proizvoditelej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-realtek-sdk-priveli-k-problemam-v-ustrojstvah-65-proizvoditelej","title":{"rendered":"Vulnerabilities in Realtek SDK have led to issues in devices from 65 manufacturers.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The components of Realtek SDK, used by various manufacturers of wireless devices in their firmware, have revealed four vulnerabilities that allow an unauthenticated attacker to remotely execute code on devices with elevated privileges. Preliminary estimates indicate that the issues affect at least 200 device models from 65 different suppliers, including various models of wireless routers from Asus, A-Link, Beeline, Belkin, Buffalo, D-Link, Edison, Huawei, LG, Logitec, MT-Link, Netgear, Realtek, Smartlink, UPVEL, ZTE, and Zyxel. <\/p>\n
The problem affects various classes of wireless devices based on the RTL8xxx SoC, from wireless routers and Wi-Fi extenders to IP cameras and smart lighting control devices. Devices based on RTL8xxx chips utilize a architecture that involves installing two SoCs \u2014 the first one runs the manufacturer's Linux-based firmware, while the second runs a separate, stripped-down Linux environment that implements access point functionality. The hardware of the second environment is based on standard components provided by Realtek in the SDK. These components handle the data generated as a result of sending external requests. <\/p>\n
The vulnerabilities affect products using Realtek SDK v2.x, Realtek 'Jungle' SDK v3.0-3.4, and Realtek 'Luna' SDK up to version 1.3.2. Fixes have already been released in the Realtek 'Luna' SDK 1.3.2a update, and patches for the Realtek 'Jungle' SDK are being prepared for publication. There are no plans to release fixes for Realtek SDK 2.x, as support for that branch has already been discontinued. Working exploit prototypes have been provided for all vulnerabilities, allowing for the execution of custom code on the device. <\/p>\n
The identified vulnerabilities (the first two are assigned a severity level of 8.1, while the others are rated 9.8): <\/p>\n
\n
CVE-2021-35392 \u2014 buffer overflow in mini_upnpd and wscd processes, which implement 'WiFi Simple Config' functionality (mini_upnpd handles SSDP packet processing, while wscd also supports SSDP and manages UPnP requests based on the HTTP protocol). An attacker can achieve code execution by sending specially crafted UPnP 'SUBSCRIBE' requests with an excessively large port number in the 'Callback' field. SUBSCRIBE \/upnp\/event\/WFAWLANConfig1 HTTP\/1.1 Host: 192.168.100.254:52881 Callback: NT: upnp:event\n
CVE-2021-35393 \u2014 a vulnerability in 'WiFi Simple Config' handlers that manifests when using the SSDP protocol (which uses UDP and a request format similar to HTTP). The issue is caused by the use of a fixed buffer of 512 bytes when processing the 'ST:upnp' parameter in M-SEARCH messages sent by clients to discover services on the network.\n
CVE-2021-35394 \u2014 a vulnerability in the MP Daemon process responsible for executing diagnostic operations (ping, traceroute). The issue allows for command injection due to insufficient argument validation when executing external utilities.\n