CVE-2014-8361

CVE-2014-8361 is a significant vulnerability that was discovered in 2014. It is a remote code execution (RCE) flaw found in the Realtek Software Development Kit, which allows threat actors to execute arbitrary commands on the system. The vulnerability has been exploited by various malicious campaigns over the years, and it is one of many older flaws that attackers frequently scan for due to its high impact potential. The Akamai Security Intelligence and Response Team (SIRT) noted this vulnerability as part of a broader campaign targeting unpatched zero-day vulnerabilities, including a similar RCE vulnerability in Hadoop YARN servers. In addition, Huawei devices affected by CVE-2017-17215 were also targeted. These attacks often involve the distribution of malware through exploitation of exposed Hadoop YARN servers and security flaws in Realtek SDK devices and Huawei HG532 routers. Analysis of the infection process for the HinataBot malware revealed that it exploits the miniigd SOAP service on Realtek SDK devices (CVE-2014-8361), Huawei HG532 routers (CVE-2017-17215), and exposed Hadoop YARN servers. The command injection vulnerability (CVE-2014-8361) is used to perform multiple actions using SOAP, demonstrating how threat actors can leverage such vulnerabilities to gain control over systems and spread malware.