CVE-2021-35394

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 99.88%
EPSS Percentile: 99.96%
CISA KEV: YES — Known Exploited Vulnerability

Description

Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: cve@mitre.org
Published: 16-Aug-2021 19:15
Last Modified: 17-Jun-2026 10:57
EPSS Date: 2026-10-11
CWE: CWE-78

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2021-12-10
Remediation Due: 2021-12-24
Known Ransomware Campaign Use: Unknown
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-35394

Affected Products / Versions

realtek / rtl819x_jungle_software_development_kit
Version / affected range: * · from (inclusive) 2.0 · through (inclusive) 3.4.14b
cpe:2.3:a:realtek:rtl819x_jungle_software_development_kit:*:*:*:*:*:*:*:*

References

Last enrichment sync: 12-Oct-2026 03:03
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

The operational technology (OT) security company said it observed a spike in attempts to exploit CVE-2021-35394 (CVSS score: 9.8), a critical remote code execution (RCE) flaw in Realtek Jungle SDK starting around Cling Botnet Exploits Realtek SDK Flaw and Hides C2 in STUN Traffic

Malware (2)

MITRE ATT&CK (6)

Products (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.