⚠ Actively exploited
Added to CISA KEV on 2023-09-18. Federal agencies required to patch by 2023-10-09. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable..

CVE-2014-8361

Severity
9.8CRITICAL
EPSS
93.9%
top 0.13%
CISA KEV
KEV
Added 2023-09-18
Due 2023-10-09
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedMay 1
KEV addedSep 18
KEV dueOct 9
CISA Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages18 packages

🔴Vulnerability Details

3
GHSA
GHSA-r272-2vh9-q99x: The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request2022-05-13
CVEList
CVE-2014-8361: The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the2015-05-01
VulnCheck
Realtek SDK Improper Input Validation Vulnerability2014

💥Exploits & PoCs

1
Exploit-DB
Realtek SDK - Miniigd UPnP SOAP Command Execution (Metasploit)2015-06-01

🔍Detection Rules

2
Suricata
ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound2019-05-08
Suricata
ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-83612017-12-05

📋Vendor Advisories

1
CISA
Realtek SDK Improper Input Validation Vulnerability2023-09-18

🕵️Threat Intelligence

3
Unit42
IoT Malware Evolves to Harvest Bots by Exploiting a Zero-day Home Router Vulnerability2018-01-11
Unit42
IoT Malware Evolves to Harvest Bots by Exploiting a Zero-day Home Router Vulnerability2018-01-11
Threat Intel
Nexus Zeta
CVE-2014-8361 (CRITICAL CVSS 9.8) | The miniigd SOAP service in Realtek | cvebase.io