CVE-2021-35394

The CVE-2021-35394 vulnerability, a flaw in the software design or implementation of Realtek Jungle SDK, has seen significant exploitation by threat actors. From August to October 2022, the number of attacks attempting to exploit this remote code execution vulnerability accounted for more than 40% of the total number of attacks observed in the wild. This high volume of attacks exploiting the Realtek Jungle SDK vulnerability significantly skewed the distribution of CVE numbers in attacks during this period compared to previous quarters. In-depth analysis revealed that the attacks against the Realtek Jungle SDK remote code execution vulnerability constituted 71.4% of all critical attacks and 41.8% of the total number of attacks. The scale and frequency of these attacks underscore the severity and widespread use of this vulnerability by malicious actors. The data suggests that the vulnerability was a preferred tool for threat actors during the period under review. By April 2023, FortiGuard Labs researchers observed an ongoing hacking campaign targeting not only the Realtek (CVE-2021-35394) vulnerability but also another vulnerability, Cacti (CVE-2022-46169). These vulnerabilities were being exploited to spread ShellBot and Moobot malware. The continued exploitation of the Realtek Jungle SDK vulnerability into 2023 highlights its persistent threat and the importance of addressing such security flaws promptly.