ZeroDay Findings
Sign inSign up

Findings

CVE-2014-8361

Realtek SDK Improper Input Validation Vulnerability

Published May 1, 2015 · updated Jun 16, 2026 · dlink dir-905l firmware

Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 1, 2015 · Catalog

    Detected

    Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.

  2. Sep 18, 2023 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Oct 9, 2023 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Oct 9, 2023

Affected

  • cpe dlink/dir-501 firmwareversion unspecified
  • cpe dlink/dir-600l firmwareversion unspecified
  • cpe dlink/dir-605l firmwareversion unspecified
  • cpe dlink/dir-619l firmwareversion unspecified
  • cpe dlink/dir-809 firmwareversion unspecified
  • cpe dlink/dir-900l firmwareversion unspecified
  • cpe dlink/dir-905l firmwareversion unspecified
  • cpe realtek/realtek sdkversion unspecified
  • vendor Realtek SDKversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2014-8361

    Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2014-8361

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2014-8361

    30-day exploitation probability 100.0%

    first.org
  • Exploit DatabasePublic exploit reference37169

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit ModulesPublic exploit moduleexploit_linux/http/dlink_upnp_exec_noauth

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit ModulesPublic exploit moduleexploit_linux/http/realtek_miniigd_upnp_exec_noauth

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDVulnerability recordCVE-2014-8361

    The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.

    nvd.nist.gov
  • Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-Command-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References

CVE-2014-8361 · ZeroDay Findings