⚠ Actively exploited
Added to CISA KEV on 2023-09-18. Federal agencies required to patch by 2023-10-09. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable..
CVE-2014-8361
Severity
9.8CRITICAL
EPSS
93.9%
top 0.13%
CISA KEV
KEV
Added 2023-09-18
Due 2023-10-09
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedMay 1
KEV addedSep 18
KEV dueOct 9
CISA Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages18 packages
🔴Vulnerability Details
3GHSA▶
GHSA-r272-2vh9-q99x: The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request↗2022-05-13
CVEList▶
CVE-2014-8361: The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the↗2015-05-01