Vulnerability Description
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dlink | Dir-905L Firmware | <= 2.05b01 |
| Dlink | Dir-905L | a1 |
| Dlink | Dir-605L Firmware | <= 1.14b06 |
| Dlink | Dir-605L | a1 |
| Dlink | Dir-600L Firmware | <= 1.15 |
| Dlink | Dir-600L | a1 |
| Dlink | Dir-619L Firmware | <= 1.15 |
| Dlink | Dir-619L | a1 |
| Dlink | Dir-809 Firmware | <= 1.04b02 |
| Dlink | Dir-809 | a1 |
| Dlink | Dir-900L Firmware | < 1.15b01 |
| Dlink | Dir-900L | a1 |
| Realtek | Realtek Sdk | - |
| Dlink | Dir-501 Firmware | <= 1.01b04 |
| Dlink | Dir-501 | a1 |
| Dlink | Dir-515 Firmware | <= 1.01b04 |
| Dlink | Dir-515 | a1 |
| Dlink | Dir-615 Firmware | 10.01b02 |
| Dlink | Dir-615 | j1 |
| Aterm | Wg1900Hp2 Firmware | <= 1.3.1 |
References
- http://jvn.jp/en/jp/JVN47580234/index.htmlThird Party Advisory
- http://jvn.jp/en/jp/JVN67456944/index.htmlThird Party Advisory
- http://packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-CommanThird Party AdvisoryVDB Entry
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055Vendor Advisory
- http://www.securityfocus.com/bid/74330Broken LinkThird Party AdvisoryVDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-15-155/Third Party AdvisoryVDB Entry
- https://sensorstechforum.com/hinatabot-cve-2014-8361-ddos/Third Party Advisory
- https://web.archive.org/web/20150909230440/http://securityadvisories.dlink.com/sThird Party Advisory
- https://www.exploit-db.com/exploits/37169/Third Party AdvisoryVDB Entry
- http://jvn.jp/en/jp/JVN47580234/index.htmlThird Party Advisory
- http://jvn.jp/en/jp/JVN67456944/index.htmlThird Party Advisory
- http://packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-CommanThird Party AdvisoryVDB Entry
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055Vendor Advisory
- http://www.securityfocus.com/bid/74330Broken LinkThird Party AdvisoryVDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-15-155/Third Party AdvisoryVDB Entry
FAQ
What is CVE-2014-8361?
CVE-2014-8361 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.
How severe is CVE-2014-8361?
CVE-2014-8361 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2014-8361?
Check the references section above for vendor advisories and patch information. Affected products include: Dlink Dir-905L Firmware, Dlink Dir-905L, Dlink Dir-605L Firmware, Dlink Dir-605L, Dlink Dir-600L Firmware.