CVE-2021-35392

What it actually does

The flaw is a remotely reachable heap buffer overflow in the Realtek Jungle SDK WiFi Simple Config service, commonly exposed through binaries named wscd or mini_upnpd. The vulnerable service processes SSDP/UPnP discovery traffic and unsafely constructs SSDP NOTIFY messages based on attacker-controlled values from the ST header in received M-SEARCH requests. A malformed or oversized ST value can corrupt heap memory in the daemon. The documented CVSS impact is denial of service, but because this is memory corruption in a network-facing embedded service, exploitation may also create device instability, watchdog reboots, or potentially code execution on some builds depending on compiler protections, memory layout, and vendor customizations.

Why it matters to the business

Affected products are typically embedded in routers, gateways, IoT devices, and consumer or small-office network equipment that may be difficult to inventory and patch. Successful exploitation can crash network services or destabilize devices, causing loss of connectivity, degraded Wi-Fi functionality, device reboots, or outages for dependent users and locations. The high EPSS score and public exploit availability increase the likelihood of opportunistic internet-scale scanning and botnet-driven exploitation, especially where UPnP/SSDP services are exposed beyond trusted local networks.

How an attack unfolds

An attacker first identifies devices exposing SSDP/UPnP discovery services, usually over UDP port 1900, and fingerprints responses for Realtek-derived WiFi Simple Config implementations such as wscd, mini_upnpd, or miniigd successors. The attacker then sends a crafted M-SEARCH request containing an ST header value designed to trigger unsafe heap operations when the service constructs a corresponding SSDP NOTIFY message. When the vulnerable daemon processes the request, heap memory is overwritten, which can terminate the service, crash the device process, or cause a reboot. In opportunistic campaigns, this would typically be automated across large address ranges, with follow-on actions focused on persistence, botnet enrollment, or repeated denial-of-service if the target device restarts the vulnerable service.

How to fix it

Upgrade affected firmware or vendor products to a release that incorporates a Realtek Jungle SDK version newer than v3.4.14B or otherwise includes the vendor’s fix for this issue. Because no universal package-level fixed version is provided, remediation must be performed through the device OEM, ISP, or firmware vendor that shipped the Realtek SDK-based image. Disable UPnP, SSDP, and WiFi Simple Config services where not required, especially on WAN-facing interfaces. Block inbound UDP port 1900 from untrusted networks and restrict SSDP/UPnP discovery to trusted local segments only. For devices that cannot be updated, isolate them on controlled network segments, prevent direct internet exposure, and consider replacement if the service remains enabled and reachable.

How to confirm the fix worked

Confirm the running firmware version against the device vendor’s security advisory or firmware release notes and verify that the build includes a Realtek Jungle SDK version later than v3.4.14B or an explicit fix for this vulnerability. From a trusted assessment host, check whether UDP port 1900 responds to SSDP M-SEARCH requests and whether UPnP/WiFi Simple Config remains exposed on untrusted interfaces. Validate perimeter controls by confirming that UDP/1900 traffic from untrusted networks is dropped. Where safe and authorized, use a non-destructive vulnerability scanner or vendor-provided test to confirm the device no longer exposes the vulnerable wscd or mini_upnpd behavior. Monitor after upgrade for repeated daemon crashes or device reboots to ensure the vulnerable code path is no longer reachable.

Typical attack path

1. Scan networks or the internet for devices responding to SSDP/UPnP discovery traffic, especially UDP port 1900.
2. Send benign M-SEARCH probes to identify devices running Realtek Jungle SDK-derived WiFi Simple Config services.
3. Deliver a malformed M-SEARCH request with an attacker-controlled ST header crafted to overflow heap memory during SSDP NOTIFY generation.
4. Trigger a crash, service failure, device reboot, or potentially memory-corruption behavior dependent on the firmware build.
5. Repeat exploitation after watchdog restart or device reboot, or combine with additional device vulnerabilities for compromise and botnet enrollment.

How to detect it

Review network telemetry, firewall logs, IDS/IPS alerts, packet captures, and NetFlow for unsolicited or high-volume UDP/1900 traffic, especially from untrusted networks or sources scanning many destinations. Inspect captured SSDP M-SEARCH requests for malformed, unusually long, or suspicious ST headers followed by device instability, service restarts, or loss of connectivity. On devices that expose system logs, look for crashes, watchdog restarts, segmentation faults, heap corruption messages, or repeated restarts of wscd, mini_upnpd, or related UPnP/WiFi Simple Config daemons. Correlate external UDP/1900 probes with device reboot events, UPnP service restarts, or sudden drops in network availability. If threat hunting across packet data, prioritize M-SEARCH requests with abnormal ST header length or nonstandard characters, and repeated NOTIFY generation shortly before daemon failure.

• UDP/1900
• 239.255.255.250:1900
• M-SEARCH * HTTP/1.1
• MAN: "ssdp:discover"
• ST:
• NOTIFY * HTTP/1.1
• wscd
• mini_upnpd
• miniigd
• heap buffer overflow
• segmentation fault
• watchdog restart

What your security team should do

• Prioritize internet-exposed or untrusted-network-exposed devices running Realtek SDK-derived firmware because exploit code is public and EPSS indicates high exploitation likelihood.
• Inventory routers, gateways, access points, IoT devices, and embedded appliances that expose SSDP/UPnP or WiFi Simple Config services.
• Obtain patched firmware from the OEM, ISP, or device vendor and upgrade affected devices; replace devices that are end-of-life or cannot receive a corrected firmware image.
• Disable UPnP, SSDP, and WiFi Simple Config where operationally unnecessary, and ensure these services are never reachable from WAN interfaces.
• Block or tightly restrict UDP port 1900 at network boundaries and between untrusted network segments.
• Add monitoring for abnormal SSDP M-SEARCH traffic, unusually long ST headers, repeated crashes of wscd or mini_upnpd, and unexplained embedded-device reboots.
• Hunt for historical signs of probing or exploitation, especially bursts of UDP/1900 traffic from external or unfamiliar sources.