ืคืืจ ืืืึทืื ืขืจืึทืืืืืืื ืืึธืื ืฉืืื ืืืืขื ืึทืคืืื ืืื ืงืึทืืคึผืึธืื ืึทื ืฅ ืคืื ืื Realtek SDK, ืืืึธืก ืืื ืืขื ืืฆื ืืืจื ืคืึทืจืฉืืื ืืืืืจืืืก ืืืื ืืึทื ืืึทืคืึทืงืืฉืขืจืขืจื ืืื ืืืืขืจ ืคืืจืืืืึทืจืข, ืืืึธืก ืงืขื ืืึธืื ืึทื ืึทื ืึธืืืขื ืืืงืืืืื ืึทืืึทืงืขืจ ืจืืืึธืืืื ืืืกืคืืจื ืงืึธื ืืืืฃ ืึท ืืืื ืืื ืขืืขืืืึทืืขื ืคึผืจืืืืืืึทืืืฉืึทื. ืืืื ืคึผืจืืืืืึทื ืขืจื ืขืกืืึทืืึทืฅ, ืื ืคึผืจืึธืืืขืืก ืืืืจืงื ืืืึท ืืื ืืกืืขืจ 200 ืืืื ืืึธืืขืืก ืคืื 65 ืคืึทืจืฉืืืขื ืข ืกืึทืคึผืืืืขืจื, ืึทืจืืึทื ืืขืจืขืื ื ืคืึทืจืฉืืื ืืึธืืขืืก ืคืื ืืืืืจืืืก ืจืึธืืืขืจืก ืึทืกืืก, ื-ืืื ืง, ืืขืขืืื ืข, ืืขืืงืื, ืืึทืคืึทืืึธื, ื-ืืื ืง, ืขืืืกืึธื, ืืืึทืืืขื, ืื, ืืึธืืืืขืืง, ืื- ืืื ืง, Netgear, Realtek, Smartlink, UPVEL, ZTE ืืื Zyxel.
ืืขืจ ืคึผืจืึธืืืขื ืงืึธืืืขืจืก ืคืึทืจืฉืืื ืงืืืกื ืคืื ืืืืืจืืืก ืืขืืืืกืขืก ืืืืืจื ืืืืฃ ืื RTL8xxx SoC, ืคึฟืื ืืืืืจืืืก ืจืึธืืืขืจืก ืืื Wi-Fi ืึทืืคึผืืึทืคืืืขืจื ืฆื IP ืงืึทืืขืจืึทืก ืืื ืงืืื ืืืืืื ื ืงืึธื ืืจืึธื ืืขืืืืกืขืก. ืืืืืืืกืึทื ืืืืืจื ืืืืฃ RTL8xxx ืืฉืืคึผืก ื ืืฆื ืึทื ืึทืจืงืึทืืขืงืืฉืขืจ ืืืึธืก ืื ืืืึทืืืื ืื ืืึทื ืืึธื ืืืจืื ื ืคืื ืฆืืืื ืกืึธืงืก - ืืขืจ ืขืจืฉืืขืจ ืื ืกืืึธืื ืื ืคืึทืืจืืงืึทื ื ืก ืืื ืืงืก-ืืืืืจื ืคืืจืืืืึทืจืข, ืืื ืื ืฆืืืืืืข ืืืืคื ืึท ืืึทืืื ืืขืจ ืกืืจืืคึผื-ืึทืจืึธืคึผ ืืื ืืงืก ืกืืืืืืข ืืื ืื ืืืคึผืืึทืืขื ืืืืฉืึทื ืคืื ืึทืงืกืขืก ืคืื ื ืคืึทื ืืงืฉืึทื ื. ืื ืคืืืื ื ืคืื ืื ืจืืข ืกืืืืืืข ืืื ืืืืืจื ืืืืฃ ื ืึธืจืืึทื ืงืึทืืคึผืึธืื ืึทื ืฅ ืฆืืืขืฉืืขืื ืืืจื Realtek ืืื ืื SDK. ืื ืงืึทืืคึผืึธืื ืึทื ืฅ ืืืื ืคึผืจืึธืฆืขืก ืืึทืื ืืืงืืืขื ืืื ืึท ืจืขืืืืืึทื ืคืื ืฉืืงื ืคืื ืืจืืืกื ืืืง ืจืืงืืืขืก.
ืื ืืืึทืื ืขืจืึทืืืืืืื ืืืืจืงื ืคึผืจืึธืืืงืื ืืืึธืก ื ืืฆื Realtek SDK v2.x, Realtek "Jungle" SDK v3.0-3.4 ืืื Realtek "Luna" SDK ืืืืืขืจ ืืืขืจืกืืข 1.3.2. ืืขืจ ืคืึทืจืจืืืื ืืื ืฉืืื ืืืคืจืืื ืืื ืื Realtek "Luna" SDK 1.3.2a ืืขืจืืืึทื ืืืงื, ืืื ืคึผืึทืืฉืึทื ืคึฟืึทืจ ืื Realtek "Jungle" SDK ืืขื ืขื ืืืื ืฆืืืขืืจืืื ืคึฟืึทืจ ืืจืืืกืืขืื. ืขืก ืืขื ืขื ืงืืื ืคึผืืึทื ื ืฆื ืืขืืืื ื ืงืืื ืคืืงืกืื ืคึฟืึทืจ Realtek SDK 2.x, ืืืืึทื ืฉืืืฆื ืคึฟืึทืจ ืืขื ืฆืืืืึทื ืืื ืฉืืื ืืืกืงืึทื ืืื ืืื. ืคึฟืึทืจ ืึทืืข ืืืึทืื ืขืจืึทืืืืืืื, ืืจืืขืื ืืืืืจืข ืคึผืจืึธืืืึทืืืืคึผืก ืืขื ืขื ืฆืืืขืฉืืขืื ืืืึธืก ืืึธืื ืืืจ ืฆื ืืืกืคืืจื ืืืื ืงืึธื ืืืืฃ ืื ืืืื.
ืืืืขื ืึทืคืืื ืืืึทืื ืขืจืึทืืืืืืื (ืื ืขืจืฉืืข ืฆืืืื ืืขื ืขื ืึทืกืืื ื ืึท ืฉืืจืขื ืืงืืึทื ืืืจืื ืคืื 8.1, ืืื ืื ืื ืืื - 9.8):
- CVE-2021-35392 - ืืึทืคืขืจ ืึธืืืืขืจืคืืึธื ืืื ืื mini_upnpd ืืื wscd ืคึผืจืึทืกืขืกืึทื ืืืึธืก ืื ืกืืจืืืขื ื ืื "WiFi Simple Config" ืคืึทื ืืงืฉืึทื ืึทืืืื (mini_upnpd ืคึผืจืึทืกืขืกืึทื SSDP ืคึผืึทืงืืฅ, ืืื wscd, ืืื ืึทืืืฉืึทื ืฆื ืฉืืืฆื SSDP, ืคึผืจืึทืกืขืกืึทื UPnP ืจืืงืืืขืก ืืืืืจื ืืืืฃ ืื ืืืืคึผ ืคึผืจืึธืืึธืงืึธื). ืึท ืึทืืึทืงืขืจ ืงืขื ืขื ืืขืจืืจืืืื ืืืจืืคืืจืื ื ืคืื ืืืืขืจ ืงืึธื ืืืจื ืฉืืงื ืกืคึผืขืฆืืขื ืงืจืึทืคืืขื UPnP "ืึทืืึธื ืืจื" ืจืืงืืืขืก ืืื ืึท ืฆื ืืจืืืก ืคึผืึธืจื ื ืืืขืจ ืืื ืื "ืงืึธืืืึทืง" ืคืขืื. ืึทืืึธื ืืจื /upnp/event/WFAWLANConfig1 ืืืืคึผ/1.1 ืืึธืกื: 192.168.100.254:52881 ืฆืืจืืงืจืืคื: NT:upnp: ืืขืฉืขืขื ืืฉ
- CVE-2021-35393 ืืื ืึท ืืืึทืื ืขืจืึทืืืืืื ืืื WiFi Simple Config ืืึทื ืืืขืจืก ืืืึธืก ืึทืงืขืจื ืืืขื ื ืืฆื ืื SSDP ืคึผืจืึธืืึธืงืึธื (ื ืืฆื UDP ืืื ืึท ืืขืื ืคึฟืึธืจืืึทื ืขื ืืขื ืฆื ืืืืคึผ). ืื ืึทืจืืืกืืขืื ืืื ืืขืคึฟืืจื ืืืจื ืื ื ืืฆื ืคืื ืึท ืคืึทืจืคืขืกืืืงื ืืึทืคืขืจ ืคืื 512 ืืืืขืก ืืืขื ืคึผืจืึทืกืขืกืื ื ืื "ST: upnp" ืคึผืึทืจืึทืืขืืขืจ ืืื M-SEARCH ืึทืจืืืงืืขื ืืขืฉืืงื ืืืจื ืงืืืืึทื ืฅ ืฆื ืืึทืฉืืืืขื ืืขื ืืืึทืืืึทื ืคืื ืกืขืจืืืืกืขืก ืืืืฃ ืื ื ืขืฅ.
- CVE-2021-35394 ืืื ืึท ืืืึทืื ืขืจืึทืืืืืื ืืื ืื MP Daemon ืคึผืจืึธืฆืขืก, ืืืึธืก ืืื ืคืึทืจืึทื ืืืืึธืจืืืขื ืคึฟืึทืจ ืืืจืืคืืจื ืืืึทืื ืึธืกืืืง ืึทืคึผืขืจืืืฉืึทื ื (ืคึผืื ื, ืืจืึทืกืขืจืึธืืืข). ืืขืจ ืคึผืจืึธืืืขื ืึทืืึทืื ืกืึทืืกืืืืืฉืึทื ืคืื ืืืื ืืืืืขื ืข ืงืึทืืึทื ืื ืจืขืื ืฆื ื ืื ืืขื ืืืืง ืงืึธื ืืจืึธืืืจืื ื ืคืื ืึทืจืืืืขื ืื ืืืขื ืขืงืกืึทืงืืืืื ื ืคืื ืืจืืืกื ืืืง ืืืืืืึทืืื.
- CVE-2021-35395 ืืื ืึท ืกืขืจืืข ืคืื โโืืืึทืื ืขืจืึทืืืืืืื ืืื ืืืขื ืื ืืขืจืคืืืกืื ืืืืืจื ืืืืฃ ืื ืืืืคึผ ืกืขืจืืืขืจืก /bin/webs ืืื /bin/boa. ืืืคึผืืฉ ืืืึทืื ืขืจืึทืืืืืืื ืืขืคึฟืืจื ืืืจื ืื ืคืขืื ืคืื ืงืึธื ืืจืึธืืืจืื ื ืึทืจืืืืขื ืื ืืืืืขืจ ืงืึทืืขืจ ืคืื ืืจืืืกื ืืืง ืืืืืืึทืืื ื ืืฆื ืื ืกืืกืืขื () ืคึฟืื ืงืฆืืข ืืขื ืขื ืืืืขื ืึทืคืืื ืืื ืืืืืข ืกืขืจืืืขืจืก. ืื ืืืคืขืจืึทื ืกืื ืงืืืขื ืืืืื ืฆื ืื ื ืืฆื ืคืื ืคืึทืจืฉืืืขื ืข ืึทืคึผืืก ืคึฟืึทืจ ืื ืคืืื. ืืืืืข ืืึทื ืืืขืจืก ืืึธืื ื ืืฉื ืึทืจืืึทื ืืขืจืขืื ื ืฉืืฅ ืงืขืื CSRF ืื ืคืืื ืืื ืื "DNS ืจืืืื ืืื ื" ืืขืื ืืง, ืืืึธืก ืึทืืึทืื ืฉืืงื ืจืืงืืืขืก ืคืื ืึท ืคืื ืืจืืืกื ืืืง ื ืขืฅ ืืฉืขืช ืจืืกืืจืืงืืื ื ืึทืงืกืขืก ืฆื ืื ืฆืืืื ื ืืืืื ืฆื ืื ืื ืขืจืืขื ื ืขืฅ. ืคึผืจืึทืกืขืกืึทื ืืืื ืืืคืึธืืืื ืฆื ืื ืคึผืจืขืืขืคืื ืขื ืืึทืฉืืืขื / ืืึทืฉืืืขื ืืฉืืื. ืืื ืืขืจืฆื, ืขืืืขืืข ืกืืึทืง ืึธืืืืขืจืคืืึธืื ืืขื ืขื ืืืืขื ืึทืคืืื ืืื ืื ืืึทื ืืืขืจืก, ืืืึธืก ืคืึทืื ืืืขื ืึทืจืืืืขื ืื ืืืึธืก ืืขื ืขื ืฆื ืืจืืืก ืืขื ืขื ืืขืฉืืงื. POST /goform/formWsc ืืืืคึผ/1.1 ืืึธืกื: 192.168.100.254 ืืื ืืึทืื-ืืขื ื: 129 ืืื ืืึทืื-ืืืคึผ: application/x-www-form-urlencoded submit-url=%2Fwlwps.asp&resetUnCfg=0&peerPin=12345678/1tconf0>XNUMX ;&setPIN=ืึธื ืืืื+PIN&configVxd=off&resetRptUnCfg=XNUMX&peerRptPin=
- ืืขืจืฆื, ืขืืืขืืข ืืขืจ ืืืึทืื ืขืจืึทืืืืืืื ืืึธืื ืฉืืื ืืืืขื ืึทืคืืื ืืื ืื UDPServer ืคึผืจืึธืฆืขืก. ืืื ืขืก ืืึธื ืืื ืึทืจืืืกืืขืืืืื, ืืื ืืืื ืข ืคืื โโืื ืคึผืจืึธืืืขืืขื ืฉืืื ืึทื ืืืขืงื ืืขืืืึธืจื ืืืจื ืึทื ืืขืจืข ืคืึธืจืฉืขืจ ืืื 2015, ืึธืืขืจ ืืื ื ืืฉื ืืึธืจ ืงืขืจืขืงื ืืขืืืึธืจื. ืืขืจ ืคึผืจืึธืืืขื ืืื ืืขืคึฟืืจื ืืืจื ืึท ืคืขืื ืคืื ืืขืืขืจืืง ืืืึทืืึทืืืืฉืึทื ืคืื ืื ืึทืจืืืืขื ืื ืืืจืืืขืืื ืืขื ืฆื ืื ืกืืกืืขื () ืคึฟืื ืงืฆืืข ืืื ืงืขื ืขื ืืืื ืขืงืกืคึผืืืืืึทื ืืืจื ืฉืืงื ืึท ืฉืืจืืงื ืืื 'orf;ls' ืฆื ื ืขืฅ ืคึผืึธืจื 9034. ืืื ืึทืืืฉืึทื, ืึท ืืึทืคืขืจ ืึธืืืืขืจืคืืึธื ืืื ืืืืขื ืึทืคืืื ืืื UDPServer ืจืขืื ืฆื ืื ืกืึทืงืืขืจ ื ืืฆื ืคืื ืื ืกืคึผืจืื ืืฃ ืคึฟืื ืงืฆืืข, ืืืึธืก ืงืขื ืขื ืืืื ืืืื ืืขื ืืฆื ืฆื ืืืจืืคืืจื ืึทืืึทืงืก.
ืืงืืจ: opennet.ru