{"metadata": {"vulnerability": "CVE-2021-35394", "count": 74, "kinds": {"milestone": 4, "sighting": 39, "kev": 15, "other": 16}, "linked_omitted": 0}, "data": [{"timestamp": "2021-06-23T00:00:00Z", "date_only": false, "value": "2021-06-23T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2021-35394", "field": "cveMetadata.dateReserved"}, {"timestamp": "2021-08-16T11:07:38Z", "date_only": false, "value": "2021-08-16T11:07:38.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-35394", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2021-08-16T11:07:38Z", "date_only": false, "value": "2021-08-16T11:07:38.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2021-35394", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2021-08-16T12:15:00Z", "date_only": false, "value": "2021-08-16T12:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9Q9F-F28Q-83XJ", "record": "GHSA-9Q9F-F28Q-83XJ", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2021-08-16T12:15:00Z", "date_only": false, "value": "2021-08-16T12:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2021-35394", "record": "GSD-2021-35394", "field": "namespaces.nvd.nist.gov.publishedDate", "linked_record": true}, {"timestamp": "2021-08-16T12:15:07.267Z", "date_only": false, "value": "2021-08-16T12:15:07.267", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-35394", "record": "FKIE_CVE-2021-35394", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2021-08-16T16:14:35Z", "date_only": false, "value": "2021-08-16T16:14:35.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/27375", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "9c8d6dd2-b355-4ebd-a853-eb68ed2e6b51", "content": "\u203c CVE-2021-35394 \u203c\n\nRealtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/27375"}, {"timestamp": "2021-08-17T19:18:26Z", "date_only": false, "value": "2021-08-17T19:18:26.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/NeKaspersky/1142", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "401a4f4b-a82c-46ac-b817-e3ef1e0bb0b6", "content": "\u0412 \u0447\u0438\u043f\u0430\u0445 Realtek \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 65 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 Realtek RTL819xD \u043a\u043e\u0441\u043d\u0443\u043b\u0430\u0441\u044c \u0441\u043e\u0442\u0435\u043d \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0421\u0440\u0435\u0434\u0438 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u0432\u0448\u0438\u0445 AsusTEK, Belkin, D-Link, Edimax \u0438 \u0434\u0440\u0443\u0433\u0438\u0435. \u0411\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0443 \u0438 \u041e\u0421. \n\n\u0412\u043e\u0442 \u0447\u0442\u043e \u0433\u043e\u0432\u043e\u0440\u044f\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 IoT Inspector, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0435\u0435: \n\n\u00ab\u041c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0438 \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u043e\u0437\u0434\u0430\u044e\u0449\u0438\u0435 \u0440\u0438\u0441\u043a\u0438 \u0434\u043b\u044f \u0441\u043e\u0442\u0435\u043d \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0421\u0430\u043c\u043e \u0441\u043e\u0431\u043e\u0439, Realtek \u0441\u0440\u0430\u0437\u0443 \u0436\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0432\u0441\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u043e \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u043f\u0430\u0442\u0447\u00bb.\n\n\u00ab\u041f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u043c\u043e\u0434\u0443\u043b\u0438 Wi-Fi, \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0437\u0430\u043f\u043b\u0430\u0442\u043a\u0438\u00bb.\n\n\u0421\u0435\u0439\u0447\u0430\u0441 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043e 4-\u0445 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u0445 \u0434\u044b\u0440:\n\nCVE-2021-35392, CVE-2021-35393, CVE-2021-35394 \u0438 CVE-2021-35395.", "url": "https://t.me/NeKaspersky/1142"}, {"timestamp": "2021-08-18T16:31:58Z", "date_only": false, "value": "2021-08-18T16:31:58.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/sysodmins/12727", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "1aae15a8-7de4-41df-aedf-50a551072763", "content": "\u200b\u200b\u041c\u0438\u043b\u043b\u0438\u043e\u043d\u044b IoT-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0432 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437-\u0437\u0430 \u0431\u0430\u0433\u043e\u0432, \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0445 \u0432 Realtek Wi-Fi SDK\n\nRealtek \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043e \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u0442\u0440\u0435\u0445 SDK \u0434\u043b\u044f \u043c\u043e\u0434\u0443\u043b\u0435\u0439 Wi-Fi. \u0414\u0430\u043d\u043d\u044b\u0435 \u043c\u043e\u0434\u0443\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043f\u043e\u0447\u0442\u0438 \u0432 200 \u043c\u043e\u0434\u0435\u043b\u044f\u0445 IoT-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 65 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439.\n\n\u0411\u0430\u0433\u0438 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u043b\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0441 \u043d\u0430\u0438\u0432\u044b\u0441\u0448\u0438\u043c \u0443\u0440\u043e\u0432\u043d\u0435\u043c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0412 SDK \u0431\u044b\u043b\u0438 \u043d\u0430\u0439\u0434\u0435\u043d\u044b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438:\n\nCVE-2021-35392 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 8,1 \u0431\u0430\u043b\u043b\u0430): \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0445\u0438\u043f\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 WiFi Simple Config \u0438\u0437-\u0437\u0430 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 SSDP NOTIFY.\nCVE-2021-35393 (\u043e\u0446\u0435\u043d\u043a\u0430 \u043f\u043e CVSS: 8,1 \u0431\u0430\u043b\u043b\u0430): \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0441\u0442\u0435\u043a\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 WiFi Simple Config \u0438\u0437-\u0437\u0430 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u043f\u0430\u0440\u0441\u0438\u043d\u0433\u0430 \u0445\u044d\u0434\u0435\u0440\u0430 UPnP SUBSCRIBE/UNSUBSCRIBE Callback.\nCVE-2021-35394 (\u043e\u0446\u0435\u043d\u043a\u0430 \u043f\u043e CVSS: 9,8 \u0431\u0430\u043b\u043b\u0430): \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043c\u0430\u043d\u0434 \u0432 MP UDPServer.\nCVE-2021-35395 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8 \u0431\u0430\u043b\u043b\u0430): \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 HTTP boa.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0443\u0433\u0440\u043e\u0437\u0443 \u0434\u043b\u044f \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432: \u0440\u043e\u0443\u0442\u0435\u0440\u044b \u0434\u043b\u044f \u043f\u0443\u0442\u0435\u0448\u0435\u0441\u0442\u0432\u0438\u0439, Wi-Fi \u0440\u0435\u043f\u0438\u0442\u0435\u0440\u044b, IP-\u043a\u0430\u043c\u0435\u0440\u044b \u0434\u043b\u044f \u0448\u043b\u044e\u0437\u043e\u0432 lightning, \u00ab\u0443\u043c\u043d\u044b\u0435\u00bb \u0438\u0433\u0440\u0443\u0448\u043a\u0438 \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0434\u0435\u0432\u0430\u0439\u0441\u044b \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 AIgital, ASUSTek, Beeline, Belkin, Buffalo, D- Link, Edimax, Huawei, LG, Logitec, MT-Link, Netis, Netgear, Occtel, PATECH, TCL, Sitecom, TCL, ZTE, Zyxel, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u0430\u044f \u043b\u0438\u043d\u0435\u0439\u043a\u0430 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432 Realtek.\n\n\u041e\u0431\u0449\u0435\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0431\u043b\u0438\u0437\u043a\u043e \u0438\u043b\u0438 \u043f\u0440\u0435\u0432\u044b\u0448\u0430\u0435\u0442 \u043c\u0438\u043b\u043b\u0438\u043e\u043d, \u0442\u0430\u043a \u043a\u0430\u043a \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u0431\u044b\u043b\u043e \u043f\u0440\u043e\u0434\u0430\u043d\u043e \u043e\u043a\u043e\u043b\u043e 5000 \u043a\u043e\u043f\u0438\u0439 \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u0434\u0435\u0432\u0430\u0439\u0441\u0430.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0438 \u0432 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u0435 Realtek \u0431\u043e\u043b\u0435\u0435 \u0434\u0435\u0441\u044f\u0442\u0438 \u043b\u0435\u0442. \u0421\u0435\u0439\u0447\u0430\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b, \u043e\u0434\u043d\u0430\u043a\u043e \u0434\u043e\u0439\u0434\u0443\u0442 \u043b\u0438 \u043f\u0430\u0442\u0447\u0438 \u0434\u043e \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0438 \u043a\u0430\u043a \u0431\u044b\u0441\u0442\u0440\u043e \u044d\u0442\u043e \u043f\u0440\u043e\u0438\u0437\u043e\u0439\u0434\u0435\u0442, \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u043b\u0438\u0448\u044c \u0434\u043e\u0433\u0430\u0434\u044b\u0432\u0430\u0442\u044c\u0441\u044f.", "url": "https://t.me/sysodmins/12727"}, {"timestamp": "2021-09-01T11:53:46Z", "date_only": false, "value": "2021-09-01T11:53:46.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/4088", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "f25752c9-c432-4977-a88e-7aa0a0ec5e2d", "content": "#WLAN_Security\nMultiple Issues in Realtek SDK Affects Hundreds of Thousands of Devices Down the Supply Chain (CVE-2021-35392, CVE-2021-35393,\nCVE-2021-35394, CVE-2021-35395)\nhttps://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain\n]-> https://blogs.juniper.net/en-us/threat-research/realtek-cve-2021-35394-exploited-in-the-wild", "url": "https://t.me/CyberSecurityTechnologies/4088", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2021-12-10T00:00:00Z", "date_only": false, "value": "2021-12-10T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-35394", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "04ff11cf-8ec7-4007-84e8-b961b9fca797", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-12-10T00:00:00Z", "date_only": false, "value": "2021-12-10T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2021-35394", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "7cceaefd-9d7b-420c-ba51-db9395f6d599", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-12-10T00:00:00Z", "date_only": true, "value": "2021-12-10", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-35394", "field": "containers.adp.1.metrics.2.other.content.dateAdded"}, {"timestamp": "2021-12-10T00:00:00Z", "date_only": true, "value": "2021-12-10", "kind": "other", "label": "Catalog added", "source": "gsd \u00b7 GSD-2021-35394", "record": "GSD-2021-35394", "field": "namespaces.cisa.gov.dateAdded", "linked_record": true}, {"timestamp": "2021-12-10T00:00:00Z", "date_only": false, "value": "2021-12-10T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2021-35394", "field": "evidence.0.details.added_date", "uuid": "7cceaefd-9d7b-420c-ba51-db9395f6d599", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-12-10T00:00:00Z", "date_only": true, "value": "2021-12-10", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2021-35394", "field": "evidence.0.details.date_added", "uuid": "04ff11cf-8ec7-4007-84e8-b961b9fca797", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-12-10T00:00:00Z", "date_only": false, "value": "2021-12-10T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2021-35394", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "04ff11cf-8ec7-4007-84e8-b961b9fca797", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-12-10T00:00:00Z", "date_only": false, "value": "2021-12-10T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2021-35394", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "7cceaefd-9d7b-420c-ba51-db9395f6d599", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-12-10T00:00:00Z", "date_only": false, "value": "2021-12-10T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2021-35394", "field": "status.status_updated_at", "uuid": "04ff11cf-8ec7-4007-84e8-b961b9fca797", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-12-10T00:00:00Z", "date_only": false, "value": "2021-12-10T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2021-35394", "field": "status.status_updated_at", "uuid": "7cceaefd-9d7b-420c-ba51-db9395f6d599", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-12-10T00:00:00Z", "date_only": false, "value": "2021-12-10T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-35394", "field": "containers.adp.1.timeline.0.time", "text": "CVE-2021-35394 added to CISA KEV"}, {"timestamp": "2021-12-24T00:00:00Z", "date_only": true, "value": "2021-12-24", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2021-35394", "field": "evidence.0.details.due_date", "uuid": "04ff11cf-8ec7-4007-84e8-b961b9fca797", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-12-24T00:00:00Z", "date_only": true, "value": "2021-12-24", "kind": "other", "label": "Remediation due", "source": "gsd \u00b7 GSD-2021-35394", "record": "GSD-2021-35394", "field": "namespaces.cisa.gov.dueDate", "linked_record": true}, {"timestamp": "2022-05-24T19:11:16Z", "date_only": false, "value": "2022-05-24T19:11:16Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9Q9F-F28Q-83XJ", "record": "GHSA-9Q9F-F28Q-83XJ", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2022-06-28T14:11:00Z", "date_only": false, "value": "2022-06-28T14:11Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2021-35394", "record": "GSD-2021-35394", "field": "namespaces.nvd.nist.gov.lastModifiedDate", "linked_record": true}, {"timestamp": "2023-01-25T15:10:06Z", "date_only": false, "value": "2023-01-25T15:10:06.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/3984", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "0c546c9b-a48f-4b41-adc0-61bfb02ffd1c", "content": "\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438 \u0438\u0437 Palo Alto Networks \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d \u0432\u0441\u043f\u043b\u0435\u0441\u043a \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Realtek Jungle SDK.\n\n\u0420\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0435 CVE-2021-35394, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043b\u0438 \u0435\u0449\u0435 \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435 2021 \u0433\u043e\u0434\u0430.\n\n\u0411\u0430\u0433\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u043e\u0442\u043d\u0438 \u0442\u0438\u043f\u043e\u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0447\u0438\u043f\u044b Realtek RTL8xxx, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u044b, \u0434\u043e\u043c\u0430\u0448\u043d\u0438\u0435 \u0448\u043b\u044e\u0437\u044b, IP-\u043a\u0430\u043c\u0435\u0440\u044b \u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u0435\u043b\u0438 Wi-Fi \u043e\u0442 66 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439, \u0441\u0440\u0435\u0434\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 Asus, Belkin, D-Link, Huawei, LG, Logitech, Netgear, ZTE \u0438 Zyxel.\n\n\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0439 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c, \u043d\u0435 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0438\u043c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445, \u043f\u043e\u043b\u0443\u0447\u0430\u044f \u043d\u0430\u0434 \u043d\u0438\u043c\u0438 \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c.\n\n\u041f\u0435\u0440\u0432\u044b\u0435 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 CVE-2021-35394, \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u043d\u0435\u0439 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0435 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u044b, \u0438 \u0435\u0449\u0435 \u0442\u043e\u0433\u0434\u0430 \u0430\u0442\u0430\u043a\u0430\u043c \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u043b\u043e\u0441\u044c \u043e\u043a\u043e\u043b\u043e \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432.\n\n\u0412 \u043d\u043e\u0432\u043e\u043c \u043e\u0442\u0447\u0435\u0442\u0435 Palo Alto Networks \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043e\u0431 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u043c \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0438 \u0447\u0438\u0441\u043b\u0430 \u0430\u0442\u0430\u043a, \u043f\u044b\u0442\u0430\u044e\u0449\u0438\u0445\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u0435\u0444\u0435\u043a\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u0422\u043e\u043b\u044c\u043a\u043e \u043f\u043e \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044e \u043d\u0430 \u0434\u0435\u043a\u0430\u0431\u0440\u044c 2022 \u0433\u043e\u0434\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 134 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043e\u043a\u043e\u043b\u043e 97% \u044d\u0442\u0438\u0445 \u0430\u0442\u0430\u043a \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u0438 \u043f\u043e\u0441\u043b\u0435 \u043d\u0430\u0447\u0430\u043b\u0430 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2022 \u0433\u043e\u0434\u0430.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442\u0441\u044f. \u0410\u043d\u0430\u043b\u0438\u0437 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u044b\u0445 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u043b, \u0447\u0442\u043e 30 \u0440\u0435\u0433\u0438\u043e\u043d\u043e\u0432 \u0431\u044b\u043b\u0438 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u043c \u0430\u0442\u0430\u043a. \n\n\u0421\u0428\u0410 \u043b\u0438\u0434\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0441 48,3%, \u0437\u0430 \u043d\u0438\u043c\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0442 \u0412\u044c\u0435\u0442\u043d\u0430\u043c \u0441 17,8% \u0438 \u0420\u043e\u0441\u0441\u0438\u044f \u0441 14,6%.\n\n\u0421\u043e \u0441\u043b\u043e\u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432, \u0432 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 \u0441\u0432\u043e\u0435\u043c \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0446\u0435\u043b\u044c\u044e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0431\u044b\u043b\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u041f\u041e, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043a\u0440\u0443\u043f\u043d\u043e\u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 IoT, \u0447\u0442\u043e, \u0432 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 \u0440\u0430\u0437, \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0438\u0432\u0430\u0435\u0442 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0449\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443 \u044d\u0442\u0438\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432.\n\n\u0411\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u044b\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u043d\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0441\u043e\u0431\u043e\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c Mirai, Gafgyt \u0438 Mozi.\n\n\u041f\u043e\u0438\u0441\u043a \u0432 Shodan, \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438, \u0432\u044b\u044f\u0432\u0438\u043b \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u043e\u043b\u0435\u0435 80 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 IoT \u043e\u0442 14 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0442\u043a\u0440\u044b\u0442 \u043f\u043e\u0440\u0442 9034.\n\n\u0418\u0437\u0443\u0447\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438, \u0447\u0442\u043e \u043d\u0430\u0438\u0431\u043e\u043b\u044c\u0448\u0435\u0439 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 D-Link (31 \u043c\u043e\u0434\u0435\u043b\u044c), \u0437\u0430 \u043d\u0438\u043c\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0442 LG, Belkin \u0438 Zyxel (\u043f\u043e 8, 6 \u0438 6 \u043a\u0430\u0436\u0434\u0430\u044f).\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Palo Alto Networks, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u0432\u0448\u0438\u0435 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u0438 \u0443\u0436\u0435 \u0434\u0430\u0432\u043d\u043e \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u041f\u041e \u0434\u043b\u044f \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0438\u043b\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0435\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u0433\u0440\u043e\u0437\u0443.", "url": "https://t.me/true_secator/3984", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2023-01-26T09:38:50Z", "date_only": false, "value": "2023-01-26T09:38:50.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/89366", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "f3e1c512-b08d-4a12-84f1-6364b6afaad6", "content": "Experts warn of a surge of attacks exploiting a Realtek Jungle SDK RCE (CVE-2021-35394)\n\nhttps://ift.tt/D4UkmKR", "url": "https://t.me/ctinow/89366", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2023-01-27T15:13:08Z", "date_only": false, "value": "2023-01-27T15:13:08.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/7dcea5c2-f43b-4076-b3f7-c9b3909aa552", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "865337ec-3b08-4f7a-9ead-707603051259"}, {"timestamp": "2023-06-14T21:10:04Z", "date_only": false, "value": "2023-06-14T21:10:04.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "6eaaf035-c6af-4002-ba43-20457e065864"}, {"timestamp": "2023-12-13T01:23:28.607Z", "date_only": false, "value": "2023-12-13T01:23:28.607861Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-35394", "record": "GSD-2021-35394", "field": "gsd.osvSchema.modified", "linked_record": true}, {"timestamp": "2024-08-04T00:33:51.334Z", "date_only": false, "value": "2024-08-04T00:33:51.334Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2021-35394", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-12-24T20:25:38.239Z", "date_only": false, "value": "2024-12-24T20:25:38.239625Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971191", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "6bdcf0d4-e153-4819-b2d2-102c3b22973d", "url": "https://feedsin.space/feed/CISAKevBot/items/2971191"}, {"timestamp": "2024-12-29T13:00:33Z", "date_only": false, "value": "2024-12-29T13:00:33.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/javascript/cves/2021/CVE-2021-35394.yaml", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "ebec9e4e-4ca1-47bf-8ed4-5879b98f1156", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/javascript/cves/2021/CVE-2021-35394.yaml"}, {"timestamp": "2025-02-04T19:37:46.125Z", "date_only": false, "value": "2025-02-04T19:37:46.125761Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-35394", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2025-02-04T19:37:46.125Z", "date_only": false, "value": "2025-02-04T19:37:46.125761Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-35394", "record": "FKIE_CVE-2021-35394", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2025-02-23T02:10:30Z", "date_only": false, "value": "2025-02-23T02:10:30.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "0e6d2bcc-2108-489a-ba55-fb37143bd72d"}, {"timestamp": "2025-03-03T10:15:46Z", "date_only": false, "value": "2025-03-03T10:15:46.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/28347c8a-8fa9-4d49-bd73-98a955d83c02", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "4e93e08e-6ba8-47d2-b470-98481a5bf487"}, {"timestamp": "2025-03-04T04:19:36Z", "date_only": false, "value": "2025-03-04T04:19:36.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/28347c8a-8fa9-4d49-bd73-98a955d83c02", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "8921ac96-6b2e-4359-9469-8a94ddf8c098"}, {"timestamp": "2025-10-21T23:25:37.658Z", "date_only": false, "value": "2025-10-21T23:25:37.658Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2021-35394", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-10-21T23:25:37.658Z", "date_only": false, "value": "2025-10-21T23:25:37.658Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-35394", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-10-22T00:32:19Z", "date_only": false, "value": "2025-10-22T00:32:19Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9Q9F-F28Q-83XJ", "record": "GHSA-9Q9F-F28Q-83XJ", "field": "modified", "linked_record": true}, {"timestamp": "2026-01-24T13:16:31.138Z", "date_only": false, "value": "2026-01-24T13:16:31.138307Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/users/hrbrmstr/statuses/115950261928520406", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "9f98e21d-ebe0-434d-819f-6c76d069c03b", "url": "https://mastodon.social/users/hrbrmstr/statuses/115950261928520406"}, {"timestamp": "2026-02-02T12:28:30.968Z", "date_only": false, "value": "2026-02-02T12:28:30.968627Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/04ff11cf-8ec7-4007-84e8-b961b9fca797", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "15f29d11-162c-44f5-a0a3-568457ba531f", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/04ff11cf-8ec7-4007-84e8-b961b9fca797", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-03-12T10:45:44Z", "date_only": false, "value": "2026-03-12T10:45:44+00:00", "kind": "kev", "label": "Asserted", "source": "cti-feed.circl.lu", "record": "CVE-2021-35394", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "aec8c947-3fea-48c3-9bec-d2cec737fac3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-03-12T10:45:44Z", "date_only": false, "value": "2026-03-12T10:45:44+00:00", "kind": "kev", "label": "First seen", "source": "cti-feed.circl.lu", "record": "CVE-2021-35394", "field": "timestamps.first_seen_at", "metric_role": "exploitation", "metric_basis": "kev_first_seen", "uuid": "aec8c947-3fea-48c3-9bec-d2cec737fac3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-03-12T10:45:44Z", "date_only": false, "value": "2026-03-12T10:45:44+00:00", "kind": "kev", "label": "Last seen", "source": "cti-feed.circl.lu", "record": "CVE-2021-35394", "field": "timestamps.last_seen_at", "uuid": "aec8c947-3fea-48c3-9bec-d2cec737fac3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-03-12T10:45:44Z", "date_only": false, "value": "2026-03-12T10:45:44+00:00", "kind": "kev", "label": "Status updated", "source": "cti-feed.circl.lu", "record": "CVE-2021-35394", "field": "status.status_updated_at", "uuid": "aec8c947-3fea-48c3-9bec-d2cec737fac3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-03-12T10:46:10.536Z", "date_only": false, "value": "2026-03-12T10:46:10.536420Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/aec8c947-3fea-48c3-9bec-d2cec737fac3", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "95448930-521e-4790-9270-5ec78b9636b2", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/aec8c947-3fea-48c3-9bec-d2cec737fac3", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-12T06:52:41.483Z", "date_only": false, "value": "2026-06-12T06:52:41.483753Z", "kind": "sighting", "label": "Seen", "source": "https://vulnerability.circl.lu/comment/c6269290-9208-4a81-a4a3-9c99d323079c", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "4bd0c33d-79ad-46d1-a186-127323fd48be", "url": "https://vulnerability.circl.lu/comment/c6269290-9208-4a81-a4a3-9c99d323079c"}, {"timestamp": "2026-06-17T03:57:29.187Z", "date_only": false, "value": "2026-06-17T03:57:29.187", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-35394", "record": "FKIE_CVE-2021-35394", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-06-19T12:47:43.617Z", "date_only": false, "value": "2026-06-19T12:47:43.617267Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/0232616a-94e4-4452-9f42-9fa50dc88009", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "e233f502-6079-4440-8710-7948454c2106", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/0232616a-94e4-4452-9f42-9fa50dc88009", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2021-35394", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "7cceaefd-9d7b-420c-ba51-db9395f6d599", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:04:51.760Z", "date_only": false, "value": "2026-06-23T14:04:51.760048Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7cceaefd-9d7b-420c-ba51-db9395f6d599", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "90455772-f3e1-4b9f-953d-f3c395bd0ab3", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7cceaefd-9d7b-420c-ba51-db9395f6d599", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-29T12:03:11.176Z", "date_only": false, "value": "2026-07-29T12:03:11.176832Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cisoclub/2217", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "12b5570d-afcd-4ba0-9c63-ff929eed5a52", "content": "\u041e\u0431\u0437\u043e\u0440 #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e (24-30 \u044f\u043d\u0432\u0430\u0440\u044f)\n\n1\ufe0f\u20e3 \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \ud83c\uddf9\ud83c\uddfc\u0442\u0430\u0439\u0432\u0430\u043d\u044c\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 QNAP \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \ud83d\udcbe\u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430\u0445 (NAS).\n\n2\ufe0f\u20e3 \u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \ud83d\udcdd\u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0432 KeePass \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-24055), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0445\u0430\u043a\u0435\u0440\u0430\u043c, \u0438\u043c\u0435\u044e\u0449\u0438\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \ud83d\udee0\u043c\u0435\u043d\u044f\u0442\u044c XML-\u0444\u0430\u0439\u043b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 KeePass \u0438 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0442\u0440\u0438\u0433\u0433\u0435\u0440.\n\n3\ufe0f\u20e3 \u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Akamai \u0437\u0430\u044f\u0432\u0438\u043b\u0438, \u0447\u0442\u043e \u0441\u0442\u0430\u0440\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Windows \ud83d\udd11CryptoAP (CVE-2022-34689) \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0443\u0433\u0440\u043e\u0436\u0430\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \ud83d\udcbbWindows \u0438 \u0426\u041e\u0414\u0430\u043c. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u043c\u0435\u0435\u0442 \u043e\u0446\u0435\u043d\u043a\u0443 CVSS 7,5 \u0437\u0430 \u0441\u0447\u0451\u0442 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439.\n\n4\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f \ud83c\udf4eApple \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2022-42856 \u0432 Webkit, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0443\u0436\u0435 \u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \ud83e\uddb9\u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438. \n\n5\ufe0f\u20e3 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Lexmark \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE), \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0431\u043e\u043b\u0435\u0435 120 \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u043e\u0432, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0431\u044b\u043b \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d PoC-\u043a\u043e\u0434. \n\n6\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Google \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \ud83d\udd27\u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0448\u0435\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 Chrome, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u043e\u0448\u0438\u0431\u043e\u043a, \u043e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \ud83d\udc65\u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438. \n\n7\ufe0f\u20e3 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f VMware \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \ud83d\udcbd\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0435 \u2755\u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u0435\u0451 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445.\n\n8\ufe0f\u20e3 \ud83e\uddb9\u0425\u0430\u043a\u0435\u0440\u044b \u043f\u044b\u0442\u0430\u044e\u0442\u0441\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Realtek \u043f\u043e\u0434 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u043c CVE-2021-35394 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8) \u2014 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u0431\u043e\u043b\u0435\u0435 134 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \ud83d\udcf2IoT-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430.", "url": "https://t.me/cisoclub/2217"}, {"timestamp": "2026-09-01T17:00:23.719Z", "date_only": false, "value": "2026-09-01T17:00:23.719750Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/6506", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "97b76571-8bc5-4c27-975e-00ae343a7323", "content": "Executive Summary\nRecent August-October 2022 observations of exploits used in the wild reveal that threat actors have been leveraging significant numbers of attacks against the Realtek Jungle SDK remote code execution vulnerability (CVE-2021-35394). They have also been making use of a newly published arbitrary file download vulnerability in BackupBuddy and taking advantage of a command injection vulnerability in Bitbucket.\nIn our observations of network security trends, Unit 42 researchers have pinpointed several attacks based on proof-of-concept (PoC) availability and impact. We have detailed below which of these we believe should be on a defender\u2019s radar\nNetwork Security Trends: August-October 2022\nhttps://unit42.paloaltonetworks.com/network-security-trends-aug-oct-2022\n\n\n\u2069-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.10.28", "url": "https://t.me/cissp/6506"}, {"timestamp": "2026-09-01T17:00:42.661Z", "date_only": false, "value": "2026-09-01T17:00:42.661382Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/4033", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "de4cf5af-cf59-48a2-b809-be46c867452b", "content": "Red Team Tactics \nThe Complete Guide to Prototype Pollution Vulnerabilities\nhttps://www.whitesourcesoftware.com/resources/blog/prototype-pollution-vulnerabilities\n\nWLAN Security\nMultiple Issues in Realtek SDK Affects Hundreds of Thousands of Devices Down the Supply Chain (CVE-2021-35392, CVE-2021-35393,\nCVE-2021-35394, CVE-2021-35395)\nhttps://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain\n\nexploit\nCVE-2021-21225:\nA vulnerability in V8's\u00a0Array.prototype.concat\u00a0implementation\nhttps://tiszka.com/blog/CVE_2021_21225.html", "url": "https://t.me/cissp/4033"}, {"timestamp": "2026-09-10T03:00:03.693Z", "date_only": false, "value": "2026-09-10T03:00:03.693429Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cissp/6506", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "dbf9685c-4c2f-4d31-acff-8d9da3ac9201", "content": "Executive Summary\nRecent August-October 2022 observations of exploits used in the wild reveal that threat actors have been leveraging significant numbers of attacks against the Realtek Jungle SDK remote code execution vulnerability (CVE-2021-35394). They have also been making use of a newly published arbitrary file download vulnerability in BackupBuddy and taking advantage of a command injection vulnerability in Bitbucket.\nIn our observations of network security trends, Unit 42 researchers have pinpointed several attacks based on proof-of-concept (PoC) availability and impact. We have detailed below which of these we believe should be on a defender\u2019s radar\nNetwork Security Trends: August-October 2022\nhttps://unit42.paloaltonetworks.com/network-security-trends-aug-oct-2022\n\n\n\u2069-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.10.28", "url": "https://t.me/cissp/6506", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-10T22:00:03.097Z", "date_only": false, "value": "2026-09-10T22:00:03.097361Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cissp/4033", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "1d404e31-5975-4c9e-abad-95a6aaf5aa94", "content": "Red Team Tactics \nThe Complete Guide to Prototype Pollution Vulnerabilities\nhttps://www.whitesourcesoftware.com/resources/blog/prototype-pollution-vulnerabilities\n\nWLAN Security\nMultiple Issues in Realtek SDK Affects Hundreds of Thousands of Devices Down the Supply Chain (CVE-2021-35392, CVE-2021-35393,\nCVE-2021-35394, CVE-2021-35395)\nhttps://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain\n\nexploit\nCVE-2021-21225:\nA vulnerability in V8's\u00a0Array.prototype.concat\u00a0implementation\nhttps://tiszka.com/blog/CVE_2021_21225.html", "url": "https://t.me/cissp/4033", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-02T20:10:12.152Z", "date_only": false, "value": "2026-10-02T20:10:12.152834Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberalliance.bsky.social/post/3mww6jcvezk2b", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "f2fa85f3-d230-4ab1-9fd1-fb39d8cebf3b", "content": "CTA member @nozominetworks.bsky.social observed multiple attempts to exploit CVE-2021-35394 affecting internet-exposed devices. Most of the activity resembled opportunistic scanning, but a subset led to a different finding...\nwww.nozominetworks.com/blog/a-stunn... \n#cybersecurity #malware", "url": "https://bsky.app/profile/cyberalliance.bsky.social/post/3mww6jcvezk2b"}, {"timestamp": "2026-10-05T11:49:33Z", "date_only": false, "value": "2026-10-05T11:49:33.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/10239", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "fde0643b-574f-4453-b61d-b07e99705615", "content": "\ud83d\udea8 Cling hides C2 commands in STUN traffic as threat actors were observed attempting to exploit Realtek Jungle SDK flaw CVE-2021-35394. A subset of that activity delivered the botnet.\n\nRead how Cling uses STUN for command-and-control, persistence, propagation, proxying, tunneling, and DoS: https://thehackernews.com/2026/10/realtek-jungle-sdk-exploit-attempts.html", "url": "https://t.me/thehackernews/10239", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-05T11:49:33Z", "date_only": false, "value": "2026-10-05T11:49:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/10239", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "bd3e93d5-c70b-4312-8512-351032418f23", "content": "\ud83d\udea8 Cling hides C2 commands in STUN traffic as threat actors were observed attempting to exploit Realtek Jungle SDK flaw CVE-2021-35394. A subset of that activity delivered the botnet.\n\nRead how Cling uses STUN for command-and-control, persistence, propagation, proxying, tunneling, and DoS: https://thehackernews.com/2026/10/realtek-jungle-sdk-exploit-attempts.html", "url": "https://t.me/thehackernews/10239"}, {"timestamp": "2026-10-05T13:22:40.168Z", "date_only": false, "value": "2026-10-05T13:22:40.168199Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mx4z5eixk42a", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "3bbc7c24-9050-48a0-8682-4b80f648faf4", "content": "Threat actors exploit patched Realtek Jungle SDK flaw CVE-2021-35394 to deploy Cling botnet malware using STUN-based command-and-control and multiple persistence methods.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mx4z5eixk42a"}, {"timestamp": "2026-10-05T13:22:41.957Z", "date_only": false, "value": "2026-10-05T13:22:41.957686Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mx4z5g5l5k2o", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "dcab52b8-c351-4d45-9d75-77a03c25b249", "content": "Threat actors exploit patched Realtek Jungle SDK flaw CVE-2021-35394 to deploy Cling botnet malware using STUN-based command-and-control and multiple persistence methods.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mx4z5g5l5k2o"}, {"timestamp": "2026-10-05T13:23:28.652Z", "date_only": false, "value": "2026-10-05T13:23:28.652106Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mx4z6susef22", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "4290b0a5-0a6a-4152-bb4f-eb25051ca1bf", "content": "Threat actors exploit patched Realtek Jungle SDK flaw CVE-2021-35394 to deploy Cling botnet malware using STUN-based command-and-control and multiple persistence methods.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mx4z6susef22"}, {"timestamp": "2026-10-05T14:05:56.628Z", "date_only": false, "value": "2026-10-05T14:05:56.628169Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mx53kqrjb624", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "25f95bbb-1720-4ec3-8c77-491694f9ab95", "content": "Threat actors are exploiting a critical Realtek SDK flaw (CVE-2021-35394) to deploy a new botnet malware called Cling. Cling repurposes [\u2026]", "url": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mx53kqrjb624"}, {"timestamp": "2026-10-05T15:42:04.406Z", "date_only": false, "value": "2026-10-05T15:42:04.406224Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/tomcat/statuses/117389061261750123", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "ee1192f4-a16e-4350-8ceb-e67108bf0a1f", "content": "\ud83d\udea8 Cling hides C2 commands in STUN traffic as threat actors were observed attempting to exploit Realtek Jungle SDK flaw CVE-2021-35394. A subset of that activity delivered the botnet.\nRead how Cling uses STUN for command-and-control, persistence, propagation, proxying, tunneling, and DoS: https://thehackernews.com/2026/10/realtek-jungle-sdk-exploit-attempts.html", "url": "https://infosec.exchange/users/tomcat/statuses/117389061261750123"}, {"timestamp": "2026-10-06T07:06:42.756Z", "date_only": false, "value": "2026-10-06T07:06:42.756995Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mx6ulzunyg2f", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "1f2ecf23-0fe5-4379-9228-8bc2e17b9c35", "content": "Cling botnet exploits Realtek Jungle SDK CVE-2021-35394 (CVSS 9.8) on routers and DVRs, then hides its C2 inside STUN traffic to Google's STUN service. Patch or retire exposed devices. https://cti.securitycyber.uk", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mx6ulzunyg2f"}, {"timestamp": "2026-10-06T09:32:12Z", "date_only": false, "value": "2026-10-06T09:32:12.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/CyberDispatch/3257", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "d4e61f1e-c555-4c0d-91cb-a5e0868de092", "content": "Cling hides C2 commands in STUN traffic as threat actors were observed attempting to exploit Realtek Jungle SDK flaw CVE-2021-35394. A subset of that activity delivered the botnet.", "url": "https://t.me/CyberDispatch/3257", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-06T14:30:16.298Z", "date_only": false, "value": "2026-10-06T14:30:16.298707Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mx7nf5yuuy2i", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "20ebc9b5-93fd-49a8-bcfe-7fd1b33fb32e", "content": "New 'ClingSTUN' botnet targets routers & DVRs, exploiting flaws like CVE-2021-35394. Uniquely uses STUN protocol for C2 comms to evade detection, turning devices into proxy nodes. #Botnet #Malware #IoT #ClingSTUN\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mx7nf5yuuy2i"}, {"timestamp": "2026-10-07T08:50:04.428Z", "date_only": false, "value": "2026-10-07T08:50:04.428167Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mxbktpsv722j", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "ac0ecd15-dc6d-4239-bbba-a2f586f2db0f", "content": "Cling/ClingSTUN: botnet IoT Linux, C2 mascherato da traffico STUN (comandi nei transaction ID). Entry: CVE-2021-35394 Realtek + ~20 CVE. Detection: STUN anomalo da router/IoT. #infosec #threatintel thehackernews.com/2026/10/real...", "url": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mxbktpsv722j"}, {"timestamp": "2026-11-04T13:31:51Z", "date_only": false, "value": "2026-11-04T13:31:51+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2021-35394", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "04ff11cf-8ec7-4007-84e8-b961b9fca797", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-06T15:09:01.170Z", "date_only": false, "value": "2026-11-06T15:09:01.170816Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117552118020019411/statuses/117570121896955832", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "3f852544-7146-4db0-9a46-92a4397b0083", "content": "A Mirai-derivative, non-replicating botnet (\"geico\"), and the unpublished  Ruijie Reyee RCE it rides in on...\nTL;DR: a router / IoT / DVR botnet - \"geico\", per the name its own loader passes for tracking this RCE - is hitting Ruijie Reyee routers and assorted other devices. It's a DDoS + proxy + reverse-shell + remote-exec multitool with DHT-backed C2. Its headline door is an unauthenticated UDP -> root RCE in Ruijie's \"Easydisc\" discovery protocol, which I reproduced on real firmware in an isolated sandbox. The bug has no CVE and no advisory - yet Ruijie silently fixed it in later builds while it's being exploited in the wild. Current firmware isn't vulnerable. \n<-- The botnet -->\ngeico is Mirai-derived but it is not just a flooder. It carries ~20 DDoS methods AND a SOCKS-style proxy/relay, a reverse shell, and arbitrary command execution. Capability-wise it's a full RAT, not a one-trick DDoS bot. Compiled for 16 different platforms, (including m68k and sparc - wtf?) , three rebuilds since September, and it's placed by an external loader - it doesn't scan or self-spread. 3 confirmed vectors, several others inferred but unconfirmed..\nThe C2 is built to survive takedown. Two tiers: the primary is a handful of disposable-TLD domains whose real C2 address is hidden inside XOR-encoded DNS A records; the fallback harvests peers off the public BitTorrent DHT. Newer builds bolt on DNS-over-HTTPS and their own TLS stack. Kill the domains and it still phones home over DHT.\nOne operator runs the whole thing and delivers the same build set over several vectors, tagging each infection by route so they can count which door it came through:\ngeico  ->  Easydisc UDP/43562 (the new one - see below)water  ->  Realtek SDK UDP/9034 (CVE-2021-35394)netis  ->  Netis/Netcore backdoor UDP/53413 (CVE-2025-34117)magicdvr, adbnc, asusrt, eponsystem, leprechaun, ziggle - Vectors I have inferred by existence of their tracking tags / distribution scripts, but have not yet captured deployment attempts\nNo IDS ships an exploit signature for the Easydisc vector. Since October the senders moved to clean IPs, so signature - AND reputation-based detection both see nothing. First hit I saw was back in August; ~1000 deliveries since, almost all invisible to the usual kit.  I noticed it after looking at botnets using CVE-2021-35394 as a vector, and decided to look at all anomalous UDP packets for signs of potential payloads.\n<-- The vulnerability -->\nUDP/43562 is Easydisc, Ruijie's \"SON\" self-organising-network discovery protocol. On 2.248-era firmware, a discovery \"hello\" packet carries a networkId field that gets interpolated straight into a shell string and handed to system(). One unauthenticated datagram, plus a quote to break out of the string, and you're executing commands as root. No auth, no scanner, no second packet.\nI didn't want to rely just on a static analysis, so I reproduced it with the vendor firmware in a sandbox and ran the discovery daemon in a QEMU vm and sent it the appropriate UDP packet, which was parsed and executed as root by the vendor binary.\nVuln summary / PoC - (salt value and exact field offsets withheld for now):\ndatagram = [16-byte salted-MD5 of the body][msg_type 0x40 \"hello\"][ ... ][networkId = '; <your cmd> #]\nThe 16-byte MD5 prefix validates because the gate's salt is embedded in the firmware\nmsg_type 0x40 lands on the esw \"hello\" handler, which walks into the auto-merge path\nthe merge builder then runs, literally: system(\"dev_sta set -m esw_networkId_merge '{ ... \\\"fromNetworkId\\\":\\\"<your field>\\\" ... }'\")\nThe ' closes that single-quoted argument; everything after it runs in the shell, as root\nThat's the whole thing: no memory corruption, no ROP - just an unsanitised field dropped into system() inside single quotes.\n<-- The part that bugs me: the silent fix -->\nCurrent firmware is NOT vulnerable. Later builds reworked the sink so that field can no longer reach a shell, and added an input filter on the discovery path. Good. The problem is how quietly it happened: the release notes for those later versions mention nothing about Easydisc, SON, discovery, or any security hardening. No CVE. No advisory. Nothing.\nSo Ruijie silently changed the vulnerable code in later builds and published no advisory for it - while the old code is being actively exploited in the wild. I'm not going to claim anyone deliberately buried a known security bug; maybe it fell out of a larger rewrite. But the effect is the same for defenders: a remotely-exploitable root bug was fixed in the dark, and anyone who didn't happen to update was never told the update mattered.\nWhile I was in the firmware I also tripped over a few other issues in current releases - different bug classes, unrelated to this botnet. I'm holding those back, no specifics, precisely because unlike this one they do affect current firmware. Just flagging that this discovery-protocol RCE isn't the whole story...\n<-- For the RE / botnet-analysis crowd -->\n  A few things in here are fun to dig at:\n* C2 resolution: the real C2 address is XOR-hidden inside the DNS A records it gets back, and the fallback harvests peers off the public BitTorrent DHT (standard bootstrap routers, 20-byte IDs). Decode-the-A-record is a nice touch.* Anti-static evolution: the older builds carry a Mirai-style XOR string table; the newest one builds every string on the stack from immediates under a fresh key, so there's no ciphertext in the data section to scrape. You have to read table_init to recover the config.* Operator telemetry: the per-vector argv tags (geico, etc, listed detailed previously ) lets the operator count infections per delivery route - handy for inferring which vectors they actually care about.\n<-- If you run Ruijie Reyee -->\n* Ask yourself why an autodiscovery / management protocol is reachable from the internet at all - it shouldn't be. Get the SON service off the internet.  But i doubt the people that need to know that, would be reading this..* Get off 2.248-era firmware. Current builds fix this - and if you are vulnerable to this, you'll potentially be vulnerable to things like CVE-2026-12197 ( Which again, is for a service that should never be internet exposed )* Net tell (what you can actually see from a router/edge): tiny DNS-over-TCP lookups for odd .cfd / .top / .click names, and unexpected BitTorrent DHT chatter from a device that has no business doing torrents.\n<-- IOCs (defanged) -->\nVectors: UDP/43562 (Easydisc)  UDP/9034 (Realtek)  UDP/53413 (Netis) + othersHost artifact: an abstract unix socket as the single-instance lock, plus a TCP listener on :63464 (ss -xl / ss -ltn) DNS / IP IOC's attached as images - reasoning behind that should be somewhat obvious.Full sample hashes on request...\n<-- Contact -->\nIf you're already tracking this family under another name, the SHA-256s will line it up - full sample hashes on request. What I think is new here is the delivery vector: the Easydisc RCE, the reproduction on real firmware, and that it's a silent n-day.\nOn why this is public rather than a quiet vendor email: Ruijie is a Chinese vendor, and under China's 2021 vulnerability rules (RMSV) bugs route into a government reporting system (MIIT) with hard limits on public disclosure. In practice a vendor-only report tends to stay with the vendor - and the state - and may never reach the public unless something forces it. This bug is already fixed and already exploited in the wild, so publishing mitigations and IOCs (no weaponised detail) is what actually helps the people running these boxes. I tried a couple of orgs quietly first and got crickets, so - YOLO - here it is.\nIndependent CERTs / CNAs (CISA ICS and the like) and fellow researchers, freaks, and geeks: if you want the full writeup - salt, offsets, hashes, pcaps - my DMs are open.\n#threatintel #IoT #Mirai #botnet #Ruijie #Reyee #infosec #malware #DFIR", "url": "https://infosec.exchange/ap/users/117552118020019411/statuses/117570121896955832"}, {"timestamp": "2026-11-06T18:19:32Z", "date_only": false, "value": "2026-11-06T18:19:32.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/28347c8a-8fa9-4d49-bd73-98a955d83c02", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "180555f7-e8a5-4f54-9603-29c96e617992"}, {"timestamp": "2026-11-07T18:07:19Z", "date_only": false, "value": "2026-11-07T18:07:19.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/28347c8a-8fa9-4d49-bd73-98a955d83c02", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "446d6710-9ebf-4555-abba-009cde0447f5"}], "metrics": {"as_of": "2026-11-14T08:28:19.050Z", "anchors": {"origin": {"timestamp": "2021-08-16T11:07:38Z", "date_only": false, "value": "2021-08-16T11:07:38.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-35394", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2021-08-16T11:07:38Z", "date_only": false, "value": "2021-08-16T11:07:38.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-35394", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2021-09-01T11:53:46Z", "date_only": false, "value": "2021-09-01T11:53:46.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/4088", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "f25752c9-c432-4977-a88e-7aa0a0ec5e2d", "content": "#WLAN_Security\nMultiple Issues in Realtek SDK Affects Hundreds of Thousands of Devices Down the Supply Chain (CVE-2021-35392, CVE-2021-35393,\nCVE-2021-35394, CVE-2021-35395)\nhttps://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain\n]-> https://blogs.juniper.net/en-us/threat-research/realtek-cve-2021-35394-exploited-in-the-wild", "url": "https://t.me/CyberSecurityTechnologies/4088", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2021-12-10T00:00:00Z", "date_only": false, "value": "2021-12-10T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-35394", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "04ff11cf-8ec7-4007-84e8-b961b9fca797", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 9982342.0, "hours": 2772.8727777777776, "days": 115.53636574074073, "min_seconds": 9982342.0, "max_seconds": 10068742.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-08-16T11:07:38Z", "date_only": false, "value": "2021-08-16T11:07:38.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-35394", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2021-12-10T00:00:00Z", "date_only": false, "value": "2021-12-10T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-35394", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "04ff11cf-8ec7-4007-84e8-b961b9fca797", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 9982342.0, "hours": 2772.8727777777776, "days": 115.53636574074073, "min_seconds": 9982342.0, "max_seconds": 10068742.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-08-16T11:07:38Z", "date_only": false, "value": "2021-08-16T11:07:38.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-35394", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2021-12-10T00:00:00Z", "date_only": false, "value": "2021-12-10T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-35394", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "04ff11cf-8ec7-4007-84e8-b961b9fca797", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 1385168.0, "hours": 384.7688888888889, "days": 16.032037037037036, "min_seconds": 1385168.0, "max_seconds": 1385168.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-08-16T11:07:38Z", "date_only": false, "value": "2021-08-16T11:07:38.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-35394", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2021-09-01T11:53:46Z", "date_only": false, "value": "2021-09-01T11:53:46.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/4088", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "f25752c9-c432-4977-a88e-7aa0a0ec5e2d", "content": "#WLAN_Security\nMultiple Issues in Realtek SDK Affects Hundreds of Thousands of Devices Down the Supply Chain (CVE-2021-35392, CVE-2021-35393,\nCVE-2021-35394, CVE-2021-35395)\nhttps://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain\n]-> https://blogs.juniper.net/en-us/threat-research/realtek-cve-2021-35394-exploited-in-the-wild", "url": "https://t.me/CyberSecurityTechnologies/4088", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 165532841.050478, "hours": 45981.34473624389, "days": 1915.8893640101621, "min_seconds": 165532841.050478, "max_seconds": 165532841.050478, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-08-16T11:07:38Z", "date_only": false, "value": "2021-08-16T11:07:38.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-35394", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T08:28:19.050Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 155550499.050478, "hours": 43208.471958466114, "days": 1800.3529982694215, "min_seconds": 155464099.050478, "max_seconds": 155550499.050478, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-12-10T00:00:00Z", "date_only": false, "value": "2021-12-10T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-35394", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "04ff11cf-8ec7-4007-84e8-b961b9fca797", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-11-14T08:28:19.050Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 164147673.050478, "hours": 45596.575847355, "days": 1899.857326973125, "min_seconds": 164147673.050478, "max_seconds": 164147673.050478, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-09-01T11:53:46Z", "date_only": false, "value": "2021-09-01T11:53:46.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/4088", "record": "CVE-2021-35394", "field": "creation_timestamp", "uuid": "f25752c9-c432-4977-a88e-7aa0a0ec5e2d", "content": "#WLAN_Security\nMultiple Issues in Realtek SDK Affects Hundreds of Thousands of Devices Down the Supply Chain (CVE-2021-35392, CVE-2021-35393,\nCVE-2021-35394, CVE-2021-35395)\nhttps://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain\n]-> https://blogs.juniper.net/en-us/threat-research/realtek-cve-2021-35394-exploited-in-the-wild", "url": "https://t.me/CyberSecurityTechnologies/4088", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-14T08:28:19.050Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}