CVE-2021-35395

What it actually does

The flaw is a set of remotely reachable memory-safety and command-injection vulnerabilities in HTTP management services derived from the Realtek Jungle/AP-Router SDK v2.x through v3.4.14B. The affected Boa- and GoAhead-based web servers expose handler functions such as formSysCmd, formWsc, formRebootCheck, formWlanMultipleAP, formWlSiteSurvey, and formStaticDHCP that unsafely copy or execute attacker-controlled request parameters. Depending on how the downstream device vendor integrated the SDK, an unauthenticated network attacker can trigger stack buffer overflows or inject operating-system commands, resulting in arbitrary code execution with the privileges of the embedded web server, often root on small router/AP firmware.

Why it matters to the business

Successful exploitation can give an attacker full control of affected routers, access points, gateways, repeaters, or embedded products using the vulnerable Realtek SDK code. Compromised devices can be added to botnets, used for traffic interception, internal network pivoting, credential theft, distributed denial-of-service activity, or persistent unauthorized access. This vulnerability is CISA KEV-listed, has been observed exploited in the wild, has a very high EPSS likelihood, and the CISA remediation deadline of 2021-11-17 has long passed, so any remaining exposure should be treated as urgent technical debt. Because Realtek SDK code is widely reused by downstream vendors, exposure may exist even when the product is not visibly branded as Realtek.

How an attack unfolds

An attacker first identifies an internet- or LAN-reachable embedded web management interface derived from the Realtek SDK, commonly served by Boa or GoAhead. They then send crafted HTTP requests to vulnerable form handlers such as formSysCmd or formWsc. For command-injection variants, attacker-controlled parameters are passed into shell execution paths, causing the device to run arbitrary commands. For stack-overflow variants, oversized parameters corrupt stack memory and may redirect execution to attacker-controlled code, with exploitability varying by firmware build, compiler protections, architecture, and vendor modifications. After code execution, attackers commonly retrieve a payload, start a botnet or backdoor process, alter configuration, disable competing malware, and use the device for scanning, proxying, DDoS, or lateral movement. Public exploitation has targeted this Realtek AP-router SDK vulnerability class at scale, so opportunistic scanning should be expected on any exposed management interface.

How to fix it

Apply vendor firmware updates that remove or harden the vulnerable Realtek SDK webserver code. Realtek SDK v2.x through v3.4.14B should be considered affected unless the downstream vendor has confirmed the vulnerable handlers were removed or fixed. If firmware cannot be updated, replace the device or remove it from exposed networks. Disable remote/WAN-side administration, restrict management interfaces to a dedicated trusted management network, block inbound access to device HTTP/HTTPS management ports from untrusted networks, and enforce strong network segmentation around embedded devices. Where source dependencies are relevant, update affected Git packages to the fixed commits: metamorphic-spyware/enrocrypt at e652d56ac60eadfc26489ab83927af13a9b9d8ce and morgan-phoenix/enrocrypt at cf883225a06bac73c564cff83af5e3f9386de116. Treat mitigation by firewalling as temporary; the durable fix is vendor-supplied firmware or device replacement.

How to confirm the fix worked

Inventory network devices and embedded products for Boa, GoAhead, Realtek SDK, AP-router SDK, Jungle SDK, /goform/, or /boaform/ management interfaces. Confirm each device model and firmware version against the vendor advisory or firmware release notes, not Realtek branding alone, because vendors often repackage the SDK. Validate that management interfaces are not reachable from the internet or untrusted VLANs. After upgrading, confirm the installed firmware version, verify that vulnerable handlers are removed or require proper authorization, and perform non-destructive HTTP checks for the presence of endpoints such as /goform/formSysCmd, /boaform/formSysCmd, /goform/formWsc, and /boaform/formWsc without sending exploit payloads. For software repositories listed as affected, confirm the deployed commit is e652d56ac60eadfc26489ab83927af13a9b9d8ce or later for metamorphic-spyware/enrocrypt and cf883225a06bac73c564cff83af5e3f9386de116 or later for morgan-phoenix/enrocrypt.

Typical attack path

1. Scan for embedded HTTP management services on router/AP-style devices, especially Boa or GoAhead web servers.
2. Fingerprint Realtek SDK-derived endpoints such as /goform/ or /boaform/ handlers.
3. Send crafted HTTP requests to vulnerable handlers such as formSysCmd, formWsc, formRebootCheck, formWlanMultipleAP, formWlSiteSurvey, or formStaticDHCP.
4. Trigger command injection through parameters such as sysCmd or peerPin, or trigger stack corruption through oversized submit-url, ifname, hostname, or peerPin values.
5. Execute shell commands under the web server context, often with elevated privileges on embedded firmware.
6. Download and launch malware or a botnet implant using built-in utilities such as busybox, wget, tftp, curl, or ftpget where available.
7. Establish persistence where the firmware permits it, modify device configuration, scan for additional victims, or use the device as a proxy/DDoS node.

How to detect it

Look for evidence in edge firewall logs, reverse proxy logs if present, IDS/IPS alerts, packet captures, NetFlow, DNS logs, DHCP logs, and any device web/access logs retained by the firmware or centralized syslog. High-value indicators include HTTP requests to /goform/ or /boaform/ endpoints with handler names such as formSysCmd or formWsc, parameters named sysCmd or peerPin, unusually long submit-url, ifname, hostname, or peerPin values, and requests followed by outbound connections from the device to unfamiliar IPs. On compromised embedded Linux devices, inspect volatile process lists, startup scripts, cron entries, writable temporary directories, and command history where available for unexpected busybox, wget, curl, tftp, ftpget, telnetd, dropbear, sh, or malware-like processes. Network-level evidence is often more reliable than host logs because many affected devices have limited logging and attackers may reboot or overwrite volatile artifacts. Correlate suspected exploit requests with subsequent outbound downloads, DNS lookups, scanning behavior, DDoS traffic, configuration changes, or unexpected management logins.

• /goform/formSysCmd
• /boaform/formSysCmd
• /goform/formWsc
• /boaform/formWsc
• /goform/formRebootCheck
• /boaform/formRebootCheck
• /goform/formWlanMultipleAP
• /boaform/formWlanMultipleAP
• /goform/formWlSiteSurvey
• /boaform/formWlSiteSurvey
• /goform/formStaticDHCP
• /boaform/formStaticDHCP
• sysCmd=
• peerPin=
• submit-url=
• ifname=
• hostname=
• formSysCmd
• formWsc
• formRebootCheck
• formWlanMultipleAP
• formWlSiteSurvey
• formStaticDHCP
• boa
• webs
• GoAhead
• /bin/busybox
• /tmp/busybox
• /tmp/.sh
• /var/tmp/
• wget http://
• curl http://
• tftp -g
• ftpget
• telnetd
• dropbear

What your security team should do

• Immediately identify internet-facing embedded web management interfaces and block external access to them, prioritizing Boa/GoAhead and Realtek SDK-derived devices.
• Patch or replace all affected devices; because this is KEV-listed and actively exploited, do not rely on default credentials, obscurity, or management-interface exposure controls as the only long-term fix.
• Segment routers, access points, cameras, IoT gateways, and similar embedded devices from user, server, and administrative networks wherever possible.
• Review firewall, proxy, IDS/IPS, and NetFlow data for historical requests to vulnerable /goform/ and /boaform/ handlers and for suspicious outbound downloads from embedded devices.
• Hunt for post-exploitation behavior such as unexpected outbound connections, scanning, high bandwidth usage, DNS lookups to unknown infrastructure, or spawned shell/download utilities on devices.
• Reset and reconfigure any suspected compromised device after firmware upgrade; for high-confidence compromise, replace the device or perform a trusted factory reflash because embedded persistence may be difficult to prove absent.
• Add SIEM and network detection for requests containing formSysCmd, formWsc, sysCmd, peerPin, oversized submit-url, ifname, or hostname parameters against embedded management interfaces.
• Track downstream vendor advisories, since affected exposure depends on how each manufacturer integrated or modified the Realtek SDK.