CVE-2021-35395

{"id": "CVE-2021-35395", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-08-16T12:15:07.300", "references": [{"url": "https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf", "tags": ["Patch"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface exists: one based on Go-Ahead named webs and another based on Boa named boa. Both of them are affected by these vulnerabilities. Specifically, these binaries are vulnerable to the following issues: - stack buffer overflow in formRebootCheck due to unsafe copy of submit-url parameter - stack buffer overflow in formWsc due to unsafe copy of submit-url parameter - stack buffer overflow in formWlanMultipleAP due to unsafe copy of submit-url parameter - stack buffer overflow in formWlSiteSurvey due to unsafe copy of ifname parameter - stack buffer overflow in formStaticDHCP due to unsafe copy of hostname parameter - stack buffer overflow in formWsc due to unsafe copy of 'peerPin' parameter - arbitrary command execution in formSysCmd via the sysCmd parameter - arbitrary command injection in formWsc via the 'peerPin' parameter Exploitability of identified issues will differ based on what the end vendor/manufacturer did with the Realtek SDK webserver. Some vendors use it as-is, others add their own authentication implementation, some kept all the features from the server, some remove some of them, some inserted their own set of features. However, given that Realtek SDK implementation is full of insecure calls and that developers tends to re-use those examples in their custom code, any binary based on Realtek SDK webserver will probably contains its own set of issues on top of the Realtek ones (if kept). Successful exploitation of these issues allows remote attackers to gain arbitrary code execution on the device."}, {"lang": "es", "value": "Realtek Jungle SDK versiones v2.x hasta v3.4.14B, proporciona un servidor web HTTP que expone una interfaz de administraci\u00f3n que puede ser usada para configurar el punto de acceso. Se presentan dos versiones de esta interfaz de administraci\u00f3n: una basada en Go-Ahead denominada webs y otra basada en Boa denominada boa. Ambas est\u00e1n afectadas por estas vulnerabilidades. Espec\u00edficamente, estos binarios son vulnerables a los siguientes problemas - desbordamiento del b\u00fafer de la pila en formRebootCheck debido a una copia no segura del par\u00e1metro submit-url - desbordamiento del b\u00fafer de la pila en formWsc debido a una copia no segura del par\u00e1metro submit-url - desbordamiento del b\u00fafer de la pila en formWlanMultipleAP debido a una copia no segura del par\u00e1metro submit-url - desbordamiento del b\u00fafer de la pila en formWlSiteSurvey debido a una copia no segura del par\u00e1metro ifname - desbordamiento del b\u00fafer de la pila en formStaticDHCP debido a una copia no segura del par\u00e1metro hostname - desbordamiento del buffer de la pila en formWsc debido a una copia no segura del par\u00e1metro \"peerPin\" - ejecuci\u00f3n arbitraria de comandos en formSysCmd por medio del par\u00e1metro sysCmd - inyecci\u00f3n arbitraria de comandos en formWsc por medio del par\u00e1metro \"peerPin\". Una Explotaci\u00f3n de los problemas identificados variar\u00e1 en funci\u00f3n de lo que el proveedor/fabricante final haya hecho con el servidor web del SDK de Realtek. Algunos vendedores lo usan tal cual, otros a\u00f1aden su propia implementaci\u00f3n de autenticaci\u00f3n, algunos mantienen todas las funcionalidades del servidor, otros eliminan algunas de ellas, otros insertan su propio conjunto de caracter\u00edsticas. Sin embargo, dado que la implementaci\u00f3n del SDK de Realtek est\u00e1 llena de llamadas no seguras y que los desarrolladores tienden a reusar esos ejemplos en su c\u00f3digo personalizado, cualquier binario basado en el servidor web del SDK de Realtek probablemente contenga su propio conjunto de problemas adem\u00e1s de los de Realtek (si se mantienen). Una explotaci\u00f3n con \u00e9xito de estos problemas permite a atacantes remotos obtener una ejecuci\u00f3n de c\u00f3digo arbitrario en el dispositivo."}], "lastModified": "2023-08-08T14:21:49.707", "cisaActionDue": "2021-11-17", "cisaExploitAdd": "2021-11-03", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:realtek:realtek_jungle_sdk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D1549014-7884-44E0-8A7E-79E6CC0BAF01", "versionEndIncluding": "3.4.14b", "versionStartIncluding": "2.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "Realtek AP-Router SDK Buffer Overflow Vulnerability"}