CVE-2014-8361criticalunder attack

CVE-2014-8361

Published · Updated

Follow this CVE+ Monitor SDK

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon31 days
Published on NVDMay 1
1st PoC+31d
metasploitJul 5
CISA KEV+3062d
Action required by CISAfederal deadline: 2023-10-09

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A flaw in the Realtek SDK's miniigd SOAP service lets attackers run any code they want on affected devices by sending a specially crafted request. This is a critical vulnerability that has been actively exploited for years.

Technical detail

The miniigd SOAP service in Realtek SDK is vulnerable to unauthenticated remote code execution through a malformed NewInternalClient SOAP request. The vulnerability requires network access to the SOAP endpoint but no authentication; successful exploitation results in arbitrary code execution with device privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.