CVE-2014-8361 · netVigilance record NV23-0131

Realtek SDK Improper Input Validation

past due

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA deadline 2023-10-09 · passed 2 years 11 months ago · applies to US federal civilian agencies; used elsewhere as a reference SLA

What happened

Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.

Who is affected

Realtek SDK. Affected version ranges are listed in the vendor advisory and the NVD entry linked under Sources.

Weakness class: CWE-20.

Timeline

2023-09-18
Added to CISA KEVExploitation in the wild confirmed by CISA
2023-10-09
CISA remediation deadlinepassed 2 years 11 months ago

Sources

NVD entry for CVE-2014-8361 nvd.nist.gov/vuln/detail/CVE-2014-8361
CISA Known Exploited Vulnerabilities catalog www.cisa.gov/known-exploited-vulnerabilities-catalog
web.archive.org web.archive.org/web/20150831100501/http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055
nvd.nist.gov nvd.nist.gov/vuln/detail/CVE-2014-8361