{"id":"CVE-2014-8361","kind":"vulnerability","aliases":["CVE-2014-8361"],"related":[],"title":"The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted…","description":"Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Realtek SDK's miniigd SOAP service does not validate input in the NewInternalClient request, so a remote attacker can send a crafted request to run malicious code on the device. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2023-09-18T00:00:00+00:00","products":[{"name":"Realtek SDK","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dir-905l firmware","fixed":[],"affected":"<= 2.05b01","ecosystem":"vendor"},{"name":"dlink dir-605l firmware","fixed":[],"affected":"<= 1.14b06","ecosystem":"vendor"},{"name":"dlink dir-600l firmware","fixed":[],"affected":"<= 1.15","ecosystem":"vendor"},{"name":"dlink dir-619l firmware","fixed":[],"affected":"<= 1.15","ecosystem":"vendor"},{"name":"dlink dir-619l firmware","fixed":[],"affected":"<= 2.07b02","ecosystem":"vendor"},{"name":"dlink dir-605l firmware","fixed":[],"affected":"<= 2.07b02","ecosystem":"vendor"},{"name":"dlink dir-605l firmware","fixed":[],"affected":"<= 3.03b07","ecosystem":"vendor"},{"name":"dlink dir-600l firmware","fixed":[],"affected":"<= 2.056b06","ecosystem":"vendor"},{"name":"dlink dir-809 firmware","fixed":[],"affected":"<= 1.04b02","ecosystem":"vendor"},{"name":"dlink dir-900l firmware","fixed":["1.15b01"],"affected":"< 1.15b01","ecosystem":"vendor"},{"name":"dlink dir-501 firmware","fixed":[],"affected":"<= 1.01b04","ecosystem":"vendor"},{"name":"dlink dir-515 firmware","fixed":[],"affected":"<= 1.01b04","ecosystem":"vendor"},{"name":"dlink dir-615 firmware","fixed":[],"affected":"= 10.01b02","ecosystem":"vendor"},{"name":"dlink dir-615 firmware","fixed":[],"affected":"<= 6.06b03","ecosystem":"vendor"},{"name":"aterm wg1900hp2 firmware","fixed":[],"affected":"<= 1.3.1","ecosystem":"vendor"},{"name":"aterm wg1900hp firmware","fixed":[],"affected":"<= 2.5.1","ecosystem":"vendor"},{"name":"aterm wg1800hp4 firmware","fixed":[],"affected":"<= 1.3.1","ecosystem":"vendor"},{"name":"aterm wg1800hp3 firmware","fixed":[],"affected":"<= 1.5.1","ecosystem":"vendor"},{"name":"aterm wg1200hs2 firmware","fixed":[],"affected":"<= 2.5.0","ecosystem":"vendor"},{"name":"aterm wg1200hp3 firmware","fixed":[],"affected":"<= 1.3.1","ecosystem":"vendor"},{"name":"aterm wg1200hp2 firmware","fixed":[],"affected":"<= 2.5.0","ecosystem":"vendor"},{"name":"aterm w1200ex firmware","fixed":[],"affected":"<= 1.3.1","ecosystem":"vendor"},{"name":"aterm w1200ex-ms firmware","fixed":[],"affected":"<= 1.3.1","ecosystem":"vendor"},{"name":"aterm wg1200hs firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"aterm wg1200hp firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"aterm wf800hp firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"aterm wf300hp2 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"aterm wr8165n firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"aterm w500p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"aterm w300p firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","iot-devices","miniigd","realtek-sdk","routers"],"not_affected_if":["miniigd-disabled","no-realtek-sdk-firmware"],"how_to_check":null,"fix":"Apply the vendor mitigation per CISA's required action, or stop using the affected product. Affected firmware versions are unknown from the sources.","status":"open","published_at":"2015-05-01T15:59:01+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:04:37+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:04:37Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation per CISA's required action, or stop using the affected product. Affected firmware versions are unknown from the sources.","reach":"internet","impact":"high","summary":"Realtek SDK's miniigd SOAP service does not validate input in the NewInternalClient request, so a remote attacker can send a crafted request to run malicious code on the device. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["realtek-sdk","routers","iot-devices","miniigd"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs malicious code on the device remotely.","analyst_note":"Find affected device models and firmware versions and the vendor mitigation; check the CISA KEV entry and vendor advisories for CVE-2014-8361.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-realtek-sdk-firmware","miniigd-disabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000469,"input_tokens":2816,"output_tokens":374,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2014':19A,22A '-501':77A '-515':81A '-615':85A,89A '-809':68A '-8361':20A,23A '600l':39A,64A '605l':34A,54A,59A '619l':44A,49A '900l':73A '905l':29A 'action':218C 'activ':185B 'allow':8A,204C 'appli':219C 'arbitrari':13A 'aterm':91A,94A,97A,100A,103A,106A,109A,112A,115A,120A,123A,126A,129A,132A,135A,138A 'attack':10A,168B,206C 'cisa':181B,216C 'code':14A,177B,210C 'contain':192C 'craft':17A,172B,213C 'cve':18A,21A 'devic':145B,180B 'dir':28A,33A,38A,43A,48A,53A,58A,63A,67A,72A,76A,80A,84A,88A 'dir-600l':37A,62A 'dir-605l':32A,52A,57A 'dir-619l':42A,47A 'dir-900l':71A 'dir-905l':27A 'discontinu':225C 'dlink':26A,31A,36A,41A,46A,51A,56A,61A,66A,70A,75A,79A,83A,87A 'execut':12A,208C 'exploit':141B,186B 'firmware':30A,35A,40A,45A,50A,55A,60A,65A,69A,74A,78A,82A,86A,90A,93A,96A,99A,102A,105A,108A,111A,114A,119A,122A,125A,128A,131A,134A,137A,140A 'improp':194C 'infrastructur':142B 'input':160B,195C 'instruct':223C 'iot':144B 'iot-devic':143B 'list':182B 'malici':176B,209C 'miniigd':2A,146B,154B,200C 'mitig':220C,231C 'ms':118A 'newinternalcli':163B,214C 'per':221C 'product':229C 'realtek':6A,24A,148B,151B,190C 'realtek-sdk':147B 'remot':9A,167B,205C 'request':164B,173B,215C 'requir':217C 'router':150B 'run':175B 'sdk':7A,25A,149B,152B,191C 'send':170B 'servic':4A,156B,202C 'soap':3A,155B,201C 'unavail':233C 'use':226C 'valid':159B,196C 'vendor':222C 'via':15A,211C 'vulner':197C 'w1200ex':113A,117A 'w1200ex-ms':116A 'w300p':139A 'w500p':136A 'wf300hp2':130A 'wf800hp':127A 'wg1200hp':124A 'wg1200hp2':110A 'wg1200hp3':107A 'wg1200hs':121A 'wg1200hs2':104A 'wg1800hp3':101A 'wg1800hp4':98A 'wg1900hp':95A 'wg1900hp2':92A 'wild':189B 'wr8165n':133A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2015-05-01T15:59:01+00:00","kev":{"dateAdded":"2023-09-18","dueDate":"2023-10-09","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2014-8361","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-8361","severity":null,"published_at":"2023-09-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2014-8361","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8361","severity":null,"published_at":"2015-05-01T15:59:01+00:00","modified_at":"2026-06-17T00:16:37+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}