CVE-2014-8361

Realtek SDK Improper Input Validation

9.8 CRITICALActively exploited (CISA KEV)EPSS 100.0%

Published1 May 2015
Added to CISA KEV18 Sept 2023
Remediation due9 Oct 2023

Description

The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Realtek Sdkall versions

Aterm W1200ex Firmware≤ 1.3.1

Aterm W1200ex-ms Firmware≤ 1.3.1

Aterm W300p Firmwareall versions

Aterm W500p Firmwareall versions

Aterm Wf300hp2 Firmwareall versions

Aterm Wf800hp Firmwareall versions

Aterm Wg1200hp2 Firmware≤ 2.5.0

Aterm Wg1200hp3 Firmware≤ 1.3.1

Aterm Wg1200hp Firmwareall versions

Aterm Wg1200hs2 Firmware≤ 2.5.0

Aterm Wg1200hs Firmwareall versions

Aterm Wg1800hp3 Firmware≤ 1.5.1

Aterm Wg1800hp4 Firmware≤ 1.3.1

Aterm Wg1900hp2 Firmware≤ 1.3.1

Aterm Wg1900hp Firmware≤ 2.5.1

Aterm Wr8165n Firmwareall versions

D-Link Dir-501 Firmware≤ 1.01b04

D-Link Dir-515 Firmware≤ 1.01b04

D-Link Dir-600l Firmware≤ 1.15 · ≤ 2.056b06

D-Link Dir-605l Firmware≤ 1.14b06 · ≤ 2.07b02 · ≤ 3.03b07

D-Link Dir-615 Firmware≤ 6.06b03 · 10.01b02

D-Link Dir-619l Firmware≤ 1.15 · ≤ 2.07b02

D-Link Dir-809 Firmware≤ 1.04b02

Remediation

Fixed in

D-Link Dir-900l Firmware≥ 1.15b01

Patch & vendor advisories

http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055

References

http://jvn.jp/en/jp/JVN47580234/index.htmlThird Party Advisory
http://jvn.jp/en/jp/JVN67456944/index.htmlThird Party Advisory
http://packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-Command-Execution.htmlThird Party AdvisoryVDB Entry
http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055Vendor Advisory
https://sensorstechforum.com/hinatabot-cve-2014-8361-ddos/Third Party Advisory
https://web.archive.org/web/20150909230440/http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-8361US Government Resource
https://www.exploit-db.com/exploits/37169/Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/74330Broken LinkThird Party AdvisoryVDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-15-155/Third Party AdvisoryVDB Entry

Frequently asked

Is CVE-2014-8361 being actively exploited?

Yes. CVE-2014-8361 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 18 Sept 2023.

How severe is CVE-2014-8361?

CVE-2014-8361 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 100.0% probability of exploitation.

Which products are affected by CVE-2014-8361?

Affected products include Realtek Sdk, Aterm W1200ex Firmware, Aterm W1200ex-ms Firmware, Aterm W300p Firmware, Aterm W500p Firmware, and 19 more.

How do I fix CVE-2014-8361?

Upgrade affected software to a fixed version, for example D-Link Dir-900l Firmware 1.15b01 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2014-8361 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.