CVE-2021-35394
Published: December 10, 2021
Official Description
RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.
CISA KEV Advisory
Realtek Jungle SDK Remote Code Execution Vulnerability
RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.
Apply updates per vendor instructions.
Risk Analysis
This vulnerability in RealTek Jungle SDK involves multiple memory corruption flaws that could allow an attacker to execute code remotely. Given its high EPSS score of 0.94220 and inclusion in CISA's KEV, this is an urgent vulnerability with a high likelihood of exploitation.
Active exploitation of this vulnerability has been observed in the wild. The nature of memory corruption leading to remote code execution suggests it is remotely exploitable.
Organizations should apply available patches or updates for RealTek Jungle SDK to address these memory corruption vulnerabilities. If no specific product guidance is available, ensure all systems using this SDK are updated to the latest secure versions.
Technical Analysis
CVE-2021-35394 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2021-35394 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Exploit & PoC Resources
All References (1)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2021-35394 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1