CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Realtek SDK Improper Input Validation Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.
Affected products
dlink: dir-905l firmware; dlink: dir-905l; dlink: dir-605l firmware; dlink: dir-605l; dlink: dir-600l firmware; dlink: dir-600l; dlink: dir-619l firmware; dlink: dir-619l; dlink: dir-809 firmware; dlink: dir-809; dlink: dir-900l firmware; dlink: dir-900l; realtek: realtek sdk; dlink: dir-501 firmware; dlink: dir-501
References10
- securityadvisories.dlink.com/security/publication.aspx?name=SAP… Vendor Advisory
- securityadvisories.dlink.com/security/publication.aspx?name=SAP… Vendor Advisory
- jvn.jp/en/jp/JVN47580234/index.html Third Party Advisory
- jvn.jp/en/jp/JVN67456944/index.html Third Party Advisory
- packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-S… Third Party AdvisoryVDB Entry
- www.securityfocus.com/bid/74330 Broken LinkThird Party AdvisoryVDB Entry
- www.zerodayinitiative.com/advisories/ZDI-15-155/ Third Party AdvisoryVDB Entry
- sensorstechforum.com/hinatabot-cve-2014-8361-ddos/ Third Party Advisory
- web.archive.org/web/20150909230440/securityadvisories.dlink.com… Third Party Advisory
- www.exploit-db.com/exploits/37169/ Third Party AdvisoryVDB Entry
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 100% percentile: 100 · as of 2 November 2026