Realtek SDK Improper Input Validation Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2014-8361 · Published 01/05/2015 · updated 17/06/2026

Realtek SDK Improper Input Validation Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 18/09/2023. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
SDK Realtek	Versions not published yet (product named by CISA KEV)

Description

The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.

References

jvn.jp/en/jp/JVN47580234/index.html · Third Party Advisory
jvn.jp/en/jp/JVN67456944/index.html · Third Party Advisory
packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-Command-Execution.html · Third Party Advisory
securityadvisories.dlink.com/security/publication.aspx · Vendor Advisory
securityfocus.com/bid/74330 · Broken Link
zerodayinitiative.com/advisories/ZDI-15-155 · Third Party Advisory
sensorstechforum.com/hinatabot-cve-2014-8361-ddos · Third Party Advisory
web.archive.org/web/20150909230440/http://securityadvisories.dlink.com/security/publication.aspx · Third Party Advisory
exploit-db.com/exploits/37169 · Third Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2014-8361

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free