Veille CVE
CVE-2014-8361
9.8 Critique Exploitée activementCatalogue CISA KEV — Realtek SDK Improper Input Validation Vulnerability
Ajoutée le 18/09/2023 · Échéance de correction (agences US) : 09/10/2023
Action requise : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.
Produits concernés
- Dlink dir-905l firmware
- Dlink dir-605l firmware
- Dlink dir-600l firmware
- Dlink dir-619l firmware
- Dlink dir-809 firmware
- Dlink dir-900l firmware
- Realtek realtek sdk
- Dlink dir-501 firmware
- Dlink dir-515 firmware
- Dlink dir-615 firmware
- Aterm wg1900hp2 firmware
- Aterm wg1900hp firmware
- Aterm wg1800hp4 firmware
- Aterm wg1800hp3 firmware
- Aterm wg1200hs2 firmware
- Aterm wg1200hp3 firmware
- Aterm wg1200hp2 firmware
- Aterm w1200ex firmware
- Aterm w1200ex-ms firmware
- Aterm wg1200hs firmware
- Aterm wg1200hp firmware
- Aterm wf800hp firmware
- Aterm wf300hp2 firmware
- Aterm wr8165n firmware
- Aterm w500p firmware
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 9.8 Critique | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 10.0 Élevée | nvd@nist.gov (NVD) | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Références
- http://jvn.jp/en/jp/JVN47580234/index.html Third Party Advisory
- http://jvn.jp/en/jp/JVN67456944/index.html Third Party Advisory
- http://packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-Command-Execution.html Third Party AdvisoryVDB Entry
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055 Vendor Advisory
- http://www.securityfocus.com/bid/74330 Broken LinkThird Party AdvisoryVDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-15-155/ Third Party AdvisoryVDB Entry
- https://sensorstechforum.com/hinatabot-cve-2014-8361-ddos/ Third Party Advisory
- https://web.archive.org/web/20150909230440/http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055 Third Party Advisory
- https://www.exploit-db.com/exploits/37169/ Third Party AdvisoryVDB Entry
- http://jvn.jp/en/jp/JVN47580234/index.html Third Party Advisory
- http://jvn.jp/en/jp/JVN67456944/index.html Third Party Advisory
- http://packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-Command-Execution.html Third Party AdvisoryVDB Entry
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055 Vendor Advisory
- http://www.securityfocus.com/bid/74330 Broken LinkThird Party AdvisoryVDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-15-155/ Third Party AdvisoryVDB Entry
- https://sensorstechforum.com/hinatabot-cve-2014-8361-ddos/ Third Party Advisory
- https://web.archive.org/web/20150909230440/http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055 Third Party Advisory
- https://www.exploit-db.com/exploits/37169/ Third Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-8361 US Government Resource