CVE-2021-35395: Realtek Jungle SDK web server buffer overflow and command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no privileges or interaction required, active KEV listing, near-maximum EPSS, and confirmed public exploit material make this an urgent remote code execution risk.

What it is

The Realtek Jungle SDK (v2.x through v3.4.14B) ships an HTTP management interface, in both Go-Ahead 'webs' and Boa 'boa' variants, that mishandles several form parameters. Multiple stack buffer overflows (submit-url, ifname, hostname, peerPin) and command injection/execution flaws (sysCmd, peerPin) let a remote attacker run arbitrary code on affected access points. Because the SDK is widely reused by device vendors, exposure varies by product, but the underlying code is broadly insecure.

Impact

An unauthenticated remote attacker can achieve arbitrary code execution on the device, giving full control of the access point and any network traffic it handles.

Attack surface

Reached over the network via the device's HTTP management interface; the CVSS vector indicates no privileges or user interaction required, though the advisory notes some vendors add their own authentication layer that could change reachability.

Exploitation

Listed in CISA KEV since 2021-11-03 with a required action deadline of 2021-11-17, and EPSS 30-day probability is 0.97961 (99.9th percentile); reference tags include Exploit and Third Party Advisory, confirming public exploit material exists.

What to do

• Apply the vendor patch per the Realtek AP-Router SDK advisory (CVE-2021-35392/35395) and any downstream device firmware updates.
• Identify all devices using the Realtek Jungle SDK and confirm with each manufacturer whether the vulnerable web server is present and patched.
• Restrict management interface access to trusted networks; do not expose the HTTP admin port to the internet.
• Disable unused web management features and, where possible, replace end-of-life devices that cannot be patched.

Detection

• Monitor HTTP requests to the management interface for the vulnerable parameters: submit-url, ifname, hostname, peerPin, and sysCmd.
• Alert on long or malformed values in those parameters that suggest buffer overflow attempts.
• Watch for command-injection patterns (shell metacharacters, encoded payloads) in requests to formSysCmd and formWsc.
• Hunt for unexpected outbound connections or process execution on access points that could indicate post-exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.