CVE-2021-35394: Realtek Jungle SDK Remote Code Execution Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 99.9% chance of exploitation in the next 30 days.

Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.

Affected products

• Realtek RTL819X Jungle Software Development Kit: from 2.0, up to and including 3.4.14b

Published 2021-08-16. Last modified 2026-06-17.