CVE-2021-35394

What it actually does

CVE-2021-35394 affects the Realtek Jungle SDK diagnostic component commonly compiled as the UDPServer or MP Daemon binary. The service exposes unauthenticated network-reachable functionality and contains multiple memory corruption flaws plus an arbitrary command injection flaw. A remote attacker can send crafted network packets to vulnerable devices and cause the daemon to execute attacker-controlled operating-system commands or crash, resulting in full compromise of the embedded device with the privileges of the service, commonly root on affected IoT firmware.

Why it matters to the business

Devices built with the affected Realtek SDK, such as routers, gateways, repeaters, access points, and other embedded network appliances, can be taken over remotely without credentials. Successful exploitation can lead to device outages, traffic interception or redirection, malware installation, botnet enrollment, pivoting into internal networks, and use of the device for DDoS or proxy activity. The issue is CISA KEV-listed with a past remediation deadline of 2021-12-24, has an extremely high EPSS score, and has been actively exploited in the wild for years, so any exposed vulnerable device should be treated as high-risk even if it appears to be operating normally.

How an attack unfolds

An attacker first identifies internet-facing or locally reachable embedded devices that expose the Realtek Jungle SDK diagnostic UDP service, commonly associated with the UDPServer binary. The attacker sends crafted UDP traffic to the diagnostic service that abuses the command injection path or triggers one of the memory corruption conditions. When command injection succeeds, the daemon invokes a shell with attacker-supplied input, allowing the attacker to run commands without authentication. In real-world exploitation, attackers commonly use this access to download malware into writable temporary directories, mark it executable, run it, and then remove evidence or disable competing malware. The compromised device may then be used as part of an IoT botnet, proxy network, DDoS platform, or staging point for further attacks against networks behind the device.

How to fix it

Upgrade affected device firmware to a vendor release that incorporates Realtek Jungle SDK fixes newer than the vulnerable v2.x through v3.4.14B code line. Because no single product-wide fixed version applies across all downstream device vendors, obtain patched firmware directly from the device manufacturer or replace devices that are no longer supported. If immediate patching is not possible, disable the MP Daemon/UDPServer diagnostic service where supported, block inbound access to the diagnostic UDP service from untrusted networks, restrict device management and diagnostic interfaces to a dedicated management network, and ensure affected devices are not reachable from the internet. Apply egress filtering to prevent compromised devices from downloading malware or communicating with known botnet infrastructure. For embedded products under development, remove the diagnostic daemon from production builds or rebuild against a fixed Realtek SDK and harden command execution paths by eliminating shell invocation with untrusted input.

How to confirm the fix worked

Confirm the device model and firmware version against the manufacturer’s security advisory and verify that the installed firmware includes Realtek Jungle SDK fixes for CVE-2021-35394. From a controlled scanner, check whether UDPServer/MP Daemon is reachable from untrusted networks; the service should not be exposed publicly and ideally should not be present on production devices. On devices where shell access is available, verify that the UDPServer process is absent, disabled, or replaced by a patched binary, and confirm no unexpected child shell processes are spawned by the daemon during testing. Validate perimeter controls by confirming inbound UDP traffic to the diagnostic service is blocked from the internet and from non-management segments. After remediation, monitor for continued exploit attempts and ensure devices do not initiate unexpected outbound connections to downloader, IRC, Telnet, SSH brute-force, or botnet command-and-control infrastructure.

Typical attack path

1. Scan public IP ranges or local networks for embedded devices exposing the Realtek Jungle SDK UDPServer/MP Daemon service, commonly over UDP diagnostic ports.
2. Fingerprint the device or service behavior to confirm it responds like a vulnerable Realtek SDK implementation.
3. Send a crafted UDP packet that reaches the vulnerable diagnostic command handler or memory-corruption path.
4. Execute shell commands through the daemon without authentication, usually with elevated privileges on the device.
5. Download a payload using busybox, wget, curl, tftp, or ftpget into a writable directory such as /tmp, /var/tmp, or /dev/shm.
6. Change permissions and execute the payload, often followed by process cleanup, persistence attempts, or firewall changes.
7. Use the compromised device for botnet activity, DDoS, scanning, credential attacks, proxying, or lateral movement toward adjacent systems.

How to detect it

Look for evidence that the Realtek UDPServer/MP Daemon received suspicious crafted UDP traffic followed by command execution or outbound downloads. Relevant data sources include firewall logs, NetFlow, packet captures, NDR alerts, DNS logs, proxy logs, embedded device syslog, router management logs, and endpoint/firmware telemetry where available. Prioritize events where an embedded device received unsolicited UDP traffic on diagnostic ports, especially UDP/9034, then initiated outbound connections to unusual IP addresses, downloaded binaries, scanned other hosts, or generated high-volume DDoS-like traffic. On devices with shell access, inspect running processes and process ancestry for /bin/sh, busybox, wget, curl, tftp, ftpget, chmod, or unknown binaries spawned by UDPServer. Examine writable directories such as /tmp, /var/tmp, /dev/shm, /run, and /mnt for recently created executable files, architecture-named malware, or scripts. Review startup locations and init scripts for persistence, and compare firmware and filesystem contents against known-good images. Because many IoT botnets delete their dropped files after execution or store payloads only in memory, absence of files does not rule out exploitation; correlate network behavior before and after suspected exploit traffic.

• UDPServer
• MP Daemon
• /bin/UDPServer
• /sbin/UDPServer
• /usr/sbin/UDPServer
• UDP/9034
• udp.port == 9034
• /bin/sh -c
• busybox wget
• busybox tftp
• wget http://
• curl http://
• tftp -g
• ftpget
• chmod +x /tmp
• chmod 777 /tmp
• cd /tmp
• cd /var/tmp
• cd /dev/shm
• /tmp/.sh
• /tmp/bot
• /tmp/mips
• /tmp/mipsel
• /tmp/arm
• /tmp/arm7
• /tmp/realtek
• /var/tmp/bot
• /dev/shm/bot
• killall telnetd
• killall sshd
• iptables -F
• iptables -A INPUT

What your security team should do

• Immediately inventory routers, gateways, access points, repeaters, IP cameras, and other embedded devices that may include Realtek Jungle SDK components, prioritizing internet-facing assets.
• Treat exposed vulnerable devices as urgent because the vulnerability is KEV-listed, actively exploited in the wild, and has a very high likelihood of exploitation.
• Apply vendor firmware updates or replace unsupported devices; do not rely solely on device uptime or normal behavior as evidence of safety.
• Block inbound access to Realtek diagnostic UDP services from the internet and non-management networks, and restrict all device management functions to trusted administrative segments.
• Hunt for historical exploitation by reviewing firewall, NetFlow, DNS, EDR, NDR, and device logs for suspicious UDP probes, downloader commands, and outbound botnet-like traffic from embedded devices.
• Inspect potentially affected devices for unexpected processes, files in temporary directories, modified startup scripts, new firewall rules, and signs of malware reinfection after reboot.
• Where compromise is suspected, reimage or factory-reset the device, apply patched firmware before reconnecting it to untrusted networks, rotate any credentials that passed through or were stored on the device, and monitor adjacent systems for follow-on activity.