9.8Crítica
KEV
CVE-2014-8361Realtek SDK Improper Input Validation Vulnerability
Explotación conocida — Realtek SDK Improper Input Validation Vulnerability
CISA confirmó el 18.09.2023 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 09.10.2023.
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://web.archive.org/web/20150831100501/http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055; https://nvd.nist.gov/vuln/detail/CVE-2014-8361
Descripción
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| aterm | w1200ex firmware | ≤ 1.3.1 | |
| aterm | w1200ex-ms firmware | ≤ 1.3.1 | |
| aterm | w300p firmware | — | |
| aterm | w500p firmware | — | |
| aterm | wf300hp2 firmware | — | |
| aterm | wf800hp firmware | — | |
| aterm | wg1200hp firmware | — | |
| aterm | wg1200hp2 firmware | ≤ 2.5.0 | |
| aterm | wg1200hp3 firmware | ≤ 1.3.1 | |
| aterm | wg1200hs firmware | — | |
| aterm | wg1200hs2 firmware | ≤ 2.5.0 | |
| aterm | wg1800hp3 firmware | ≤ 1.5.1 | |
| aterm | wg1800hp4 firmware | ≤ 1.3.1 | |
| aterm | wg1900hp firmware | ≤ 2.5.1 | |
| aterm | wg1900hp2 firmware | ≤ 1.3.1 | |
| aterm | wr8165n firmware | — | |
| dlink | dir-501 firmware | ≤ 1.01b04 | |
| dlink | dir-515 firmware | ≤ 1.01b04 | |
| dlink | dir-600l firmware | ≤ 1.15 | |
| dlink | dir-605l firmware | ≤ 1.14b06 | |
| dlink | dir-615 firmware | 10.01b02 | |
| dlink | dir-619l firmware | ≤ 1.15 | |
| dlink | dir-809 firmware | ≤ 1.04b02 | |
| dlink | dir-900l firmware | < 1.15b01 | |
| dlink | dir-905l firmware | ≤ 2.05b01 | |
| realtek | realtek sdk | — |
Referencias y parches
- http://www.zerodayinitiative.com/advisories/ZDI-15-155/ Third Party AdvisoryVDB Entry
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055 Vendor Advisory
- http://packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-Command-Execution.html Third Party AdvisoryVDB Entry
- 74330 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 37169 exploitThird Party AdvisoryVDB Entry
- JVN#47580234 third-party-advisoryThird Party Advisory
- JVN#67456944 third-party-advisoryThird Party Advisory
- https://sensorstechforum.com/hinatabot-cve-2014-8361-ddos/ Third Party Advisory
- https://web.archive.org/web/20150909230440/http://securityadvisories.dlink.com/security/publication.aspx?name… Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-8361 US Government Resource
Coincidencias CPE (NVD) (31)
cpe:2.3:o:dlink:dir-905l_firmware:*:*:*:*:*:*:*:*≤ 2.05b01cpe:2.3:o:dlink:dir-605l_firmware:*:*:*:*:*:*:*:*≤ 1.14b06cpe:2.3:o:dlink:dir-600l_firmware:*:*:*:*:*:*:*:*≤ 1.15cpe:2.3:o:dlink:dir-619l_firmware:*:*:*:*:*:*:*:*≤ 1.15cpe:2.3:o:dlink:dir-619l_firmware:*:*:*:*:*:*:*:*≤ 2.07b02cpe:2.3:o:dlink:dir-605l_firmware:*:*:*:*:*:*:*:*≤ 2.07b02cpe:2.3:o:dlink:dir-605l_firmware:*:*:*:*:*:*:*:*≤ 3.03b07cpe:2.3:o:dlink:dir-600l_firmware:*:*:*:*:*:*:*:*≤ 2.056b06cpe:2.3:o:dlink:dir-809_firmware:*:*:*:*:*:*:*:*≤ 1.04b02cpe:2.3:o:dlink:dir-900l_firmware:*:*:*:*:*:*:*:*< 1.15b01cpe:2.3:a:realtek:realtek_sdk:-:*:*:*:*:*:*:*cpe:2.3:o:dlink:dir-501_firmware:*:*:*:*:*:*:*:*≤ 1.01b04cpe:2.3:o:dlink:dir-515_firmware:*:*:*:*:*:*:*:*≤ 1.01b04cpe:2.3:o:dlink:dir-615_firmware:10.01b02:*:*:*:*:*:*:*cpe:2.3:o:dlink:dir-615_firmware:*:*:*:*:*:*:*:*≤ 6.06b03cpe:2.3:o:aterm:wg1900hp2_firmware:*:*:*:*:*:*:*:*≤ 1.3.1cpe:2.3:o:aterm:wg1900hp_firmware:*:*:*:*:*:*:*:*≤ 2.5.1cpe:2.3:o:aterm:wg1800hp4_firmware:*:*:*:*:*:*:*:*≤ 1.3.1cpe:2.3:o:aterm:wg1800hp3_firmware:*:*:*:*:*:*:*:*≤ 1.5.1cpe:2.3:o:aterm:wg1200hs2_firmware:*:*:*:*:*:*:*:*≤ 2.5.0cpe:2.3:o:aterm:wg1200hp3_firmware:*:*:*:*:*:*:*:*≤ 1.3.1cpe:2.3:o:aterm:wg1200hp2_firmware:*:*:*:*:*:*:*:*≤ 2.5.0cpe:2.3:o:aterm:w1200ex_firmware:*:*:*:*:*:*:*:*≤ 1.3.1cpe:2.3:o:aterm:w1200ex-ms_firmware:*:*:*:*:*:*:*:*≤ 1.3.1cpe:2.3:o:aterm:wg1200hs_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:aterm:wg1200hp_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:aterm:wf800hp_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:aterm:wf300hp2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:aterm:wr8165n_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:aterm:w500p_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:aterm:w300p_firmware:*:*:*:*:*:*:*:*