CVE-2014-8361
CriticalActively exploited (CISA KEV)
Description
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.
SeverityCritical
CVSS9.8
Exploit probability—
ProductRealtek SDK
PublishedMay 1, 2015
First seenMay 1, 2015
Added to KEVSep 18, 2023
How to fix
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date: Oct 9, 2023Update
- dlink dir-900l_firmware1.15b01 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| realtek realtek_sdk | No range specified | — |
| dlink dir-905l_firmware | v ≤ 2.05b01 | — |
| dlink dir-605l_firmware | v ≤ 1.14b06, v ≤ 2.07b02, v ≤ 3.03b07 | — |
| dlink dir-600l_firmware | v ≤ 1.15, v ≤ 2.056b06 | — |
| dlink dir-619l_firmware | v ≤ 1.15, v ≤ 2.07b02 | — |
| dlink dir-809_firmware | v ≤ 1.04b02 | — |
| dlink dir-900l_firmware | v < 1.15b01 | 1.15b01 |
| dlink dir-501_firmware | v ≤ 1.01b04 | — |
| dlink dir-515_firmware | v ≤ 1.01b04 | — |
| dlink dir-615_firmware | 10.01b02, v ≤ 6.06b03 | — |
| aterm wg1900hp2_firmware | v ≤ 1.3.1 | — |
| aterm wg1900hp_firmware | v ≤ 2.5.1 | — |
| aterm wg1800hp4_firmware | v ≤ 1.3.1 | — |
| aterm wg1800hp3_firmware | v ≤ 1.5.1 | — |
| aterm wg1200hs2_firmware | v ≤ 2.5.0 | — |
| aterm wg1200hp3_firmware | v ≤ 1.3.1 | — |
| aterm wg1200hp2_firmware | v ≤ 2.5.0 | — |
| aterm w1200ex_firmware | v ≤ 1.3.1 | — |
| aterm w1200ex-ms_firmware | v ≤ 1.3.1 | — |
| aterm wg1200hs_firmware | No range specified | — |
| aterm wg1200hp_firmware | No range specified | — |
| aterm wf800hp_firmware | No range specified | — |
| aterm wf300hp2_firmware | No range specified | — |
| aterm wr8165n_firmware | No range specified | — |
| aterm w500p_firmware | No range specified | — |
| aterm w300p_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.