65 vendors affected by severe vulnerabilities in Realtek chips

guest · Aug 16, 2021

65 vendors affected by severe vulnerabilities in Realtek chips
August 16, 2021
https://www.helpnetsecurity.com/2021/08/16/realtek-rtl819xd-vulnerability/

A vulnerability within the Realtek RTL819xD module allows attackers to gain complete access to the device, installed operating systems and other network devices.
The chips supplied by Realtek are used by almost all well-known manufacturers and can be found in VoIP and wireless routers, repeaters, IP cameras, and smart lighting controls – just to name a few. The list of affected hardware manufacturers includes AsusTEK, Belkin, D-Link, Edimax, Hama, Netgear and many more.

“Our security reseachers have discovered and analyzed this vulnerability, which affects hundreds of thousands of devices. We notified Realtek, and they immediately responded and provided an appropriate patch. Manufacturers using vulnerable Wi-Fi modules are strongly encouraged to check their devices and provide security patches to their users,” said Florian Lukavsky, managing director of IoT Inspector.
Click to expand...

For an exploit to succeed, an attacker usually needs to be on the same Wi-Fi network. However, faulty ISP configurations also expose numerous vulnerable devices directly to the Internet.

A successful attack would provide full control of the Wi-Fi module, as well as root access to the embedded device’s operating system. In total, a dozen vulnerabilities were found in the chipset.
Click to expand...

Advisory: Multiple Issues in Realtek SDK Affects Hundreds of Thousands of Devices Down the Supply Chain

At least 65 vendors affected by severe vulnerabilities that enable unauthenticated attackers to fully compromise the target device and execute arbitrary code with the highest level of privilege.
Click to expand...

CVE IDs
CVE-2021-35392 (‘WiFi Simple Config’ stack buffer overflow via UPnP)
CVE-2021-35393 (‘WiFi Simple Config’ heap buffer overflow via SSDP)
CVE-2021-35394 (MP Daemon diagnostic tool command injection)
CVE-2021-35395 (management web interface multiple vulnerabilities)
Click to expand...

Impact
CVE-2021-35392 – 8.1 (high) AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2021-35393 – 8.1 (high) AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2021-35394 – 8.8 (high) AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2021-35395 – 8.8 (high) AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Click to expand...

guest · Aug 23, 2021

Attackers Actively Exploiting Realtek SDK Flaws
Multiple vulnerabilities in software used by 65 vendors under active attack
August 23, 2021
https://threatpost.com/attackers-exploiting-realtek/168856/

Threat actors zeroing in on command injection vulnerabilities reported in Realtek chipsets just days after multiple flaws were discovered in the software developers kits (SDK) deployed across at least 65 separate vendors.

On Aug. 16 multiple Realtek vulnerabilities were disclosed by IoT Inspector Research Lab. It took about 48 hours for attackers to start trying to exploit them. SAM Seamless Network reported two days after the bugs were made public, attackers made “multiple” attempts breach the company’s Secure Home product to spread a new version of Mirai malware.

“Specifically, we noticed exploit attempts to ‘formWsc’ and ‘formSysCmd’ web pages,” SAM’s report on the incident said.
“The exploit attempts to deploy a Mirai variant detected in March by Palo Alto Networks. Mirai is a notorious IoT and router malware circulating in various forms for the last 5 years. It was originally used to shut down large swaths of the internet but has since evolved into many variants for different purposes.”
Click to expand...

SAM said the devices most exposed to the Realtek SDK bug are:

Netis E1+ extender

Edimax N150 and N300 Wi-Fo router

Repotec RP-WR5444 router

Click to expand...

“Developers of any type of software like to use SDKs because it enables them to implement capabilities into their software without having to build it themselves,” Hank Schless from Lookout told Threatpost.
“This is broadly practiced, and there’s a level of implicit trust that developers have in those that build these SDKs that everything packaged inside of them will be safe. However, just like with any other type of software, SDKs have their inevitable flaws.”
Click to expand...

Multiple attempts to exploit Realtek vulnerabilities discovered by our researchers

One of the vulnerabilities disclosed, CVE-2021-35395 [2], affects the web interface that is part of the SDK, and is a collection of 6 different vulnerabilities. As of August 18th, we have identified attempts to exploit CVE-2021-35395 in the wild.
Same attacker – different incidents
A similar incident was reported two weeks ago, on August 6th, by Juniper Networks [5]. A newly discovered vulnerability was then exploited in the wild only 2 days after publication to spread the same Mirai variant.

The webserver serving the Mirai botnet uses the same network subnet, indicating that the same attacker is involved in both incidents.
Click to expand...

guest · Aug 12, 2022

Realtek SDK Vulnerability Exposes Routers From Many Vendors to Remote Attacks
August 12, 2022

The security hole, tracked as CVE-2022-27255 and rated ‘high severity’, has been described as a stack-based buffer overflow that can allow a remote attacker to cause a crash or achieve arbitrary code execution on devices that use the SDK. An attack can be carried out through the WAN interface using specially crafted SIP packets.

The Realtek eCos SDK is provided to companies that manufacture routers, access points and repeaters powered by RTL819x family SoCs. The SDK implements the base functionalities of the router, including the web administration interface and the networking stack. Vendors can build on top of this SDK to add custom functionality and their branding to the device.
Click to expand...

Realtek informed customers about the eCos SDK vulnerability in March, when it announced the availability of a patch. However, it’s up to the OEMs using the SDK to ensure that the patch is distributed to end-user devices.

Faraday researcher Octavio Gianatiempo, who is detailing the findings on Friday at the DEF CON conference in Las Vegas, shared some information with SecurityWeek ahead of the event.
The researcher said the vulnerability can be exploited remotely — directly from the internet — to hack affected routers running with default settings. No user interaction is required for successful exploitation.
Click to expand...

Gianatiempo said they have identified roughly 20 vendors that use the vulnerable SDK for their products, including Tenda, Nexxt, Intelbras, and D-Link. However, there could be other impacted vendors that they have yet to identify.

“The process of identifying affected OEM products is daunting due to the lack of visibility of their supply chain,” Gianatiempo noted.

Faraday has conducted a Shodan search and identified more than 60,000 vulnerable routers with their administration panel exposed. In addition, Mercadolibre, the largest ecommerce site in Latin America, has sold 130,000 devices affected by the vulnerability, according to a sales counter displayed on product pages.
Click to expand...

guest · Aug 16, 2022

mood said: ↑

Realtek SDK Vulnerability Exposes Routers From Many Vendors to Remote Attacks
August 12, 2022
Click to expand...

Exploit out for critical Realtek flaw affecting many networking devices
August 16, 2022

Exploit code has been released for a critical vulnerability affecting networking devices with Realtek’s RTL819x system on a chip (SoC), which are estimated to be in the millions.

The flaw is identified as CVE-2022-27255 and a remote attacker could exploit it to compromise vulnerable devices from various original equipment manufacturers (OEMs), ranging from routers and access points to signal repeaters.
Click to expand...

The four researchers from Faraday Security have developed proof-of-concept (PoC) exploit code for CVE-2022-27255 that works on Nexxt Nebula 300 Plus routers.
They also shared a video showing that a remote attacker could compromise the device even if remote management features are turned off.

The researchers note that CVE-2022-27255 is a zero-click vulnerability, meaning that exploitation is silent and requires no interaction from the user.
Click to expand...

Ullrich warns that if an exploit for CVE-2022-27255 turns into a worm, it could spread over the internet in minutes.
Despite a patch being available since March, Ullrich warns that the vulnerability affects "many (millions) of devices" and that a fix is unlikely to propagate to all devices.

This is because multiple vendors use the vulnerable Realtek SDK for equipment based on RTL819x SoCs and many of them have yet to release a firmware update.
Click to expand...

guest · Jan 25, 2023

Botnets exploited Realtek SDK critical bug in millions of attacks
By Bill Toulas @billtoulas - January 25, 2023

Hackers have leveraged a critical remote code execution vulnerability in Realtek Jungle SDK 134 million attacks trying to infect smart devices in the second half of 2022.
Click to expand...

Exploited by multiple threat actors, the vulnerability is tracked as CVE-2021-35394 and comes with a severity score of 9.8 out of 10.

Between August and October last year, sensors from Palo Alto Networks observed significant exploitation activity for this security issue, accounting for more than 40% of the total number of incidents.
Click to expand...

High exploitation levels
Starting September 2022, a new sizable botnet malware named ‘RedGoBot’ appeared in the wild targeting IoT devices vulnerable to CVE-2021-35394.

Researchers at Unit 42, Palo Alto Network's threat intelligence team, noticed that exploitation of the flaw continued throughout December.
Unit 42 logged activity leveraging CVE-2021-35394 from all over the world but almost half of the attacks originated from the United States.

“From August 2021 to December 2022, we have observed 134 million exploit attempts in total, targeting CVE-2021-35394, with 97% of these attacks occurring after the start of August 2022,” reads Unit 42’s report.
Click to expand...

Palo Alto Networks - Unit42: Realtek SDK Vulnerability Attacks Highlight IoT Supply Chain Threats

By Yiheng An, Chao Lei, Adam Robbie, Aveek Das, Zhibin Zhang and Shehroze Farooqi - January 24, 2023
Unit 42 researchers review tens of millions of attack records every month, and most months, attacks targeting a single vulnerability do not exceed 10% of the total number of attacks. However, we discovered that between August and October 2022, the number of attacks attempting to exploit a Realtek Jungle SDK remote code execution vulnerability (CVE-2021-35394) accounted for more than 40% of the total number of attacks.

In response to this concerning phenomenon, we dug deep into all the attack records of this vulnerability from when it was disclosed to December 2022 for analysis.
Click to expand...

Log in or Sign up

65 vendors affected by severe vulnerabilities in Realtek chips

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

65 vendors affected by severe vulnerabilities in Realtek chips

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches