--- id: "CVE-2014-8361" kind: "vulnerability" aliases: ["CVE-2014-8361"] title: "The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted\u2026" severity: "critical" cvss: 10.0 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "Realtek SDK", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dir-905l firmware", "fixed": [], "affected": "<= 2.05b01", "ecosystem": "vendor"}, {"name": "dlink dir-605l firmware", "fixed": [], "affected": "<= 1.14b06", "ecosystem": "vendor"}, {"name": "dlink dir-600l firmware", "fixed": [], "affected": "<= 1.15", "ecosystem": "vendor"}, {"name": "dlink dir-619l firmware", "fixed": [], "affected": "<= 1.15", "ecosystem": "vendor"}, {"name": "dlink dir-619l firmware", "fixed": [], "affected": "<= 2.07b02", "ecosystem": "vendor"}, {"name": "dlink dir-605l firmware", "fixed": [], "affected": "<= 2.07b02", "ecosystem": "vendor"}, {"name": "dlink dir-605l firmware", "fixed": [], "affected": "<= 3.03b07", "ecosystem": "vendor"}, {"name": "dlink dir-600l firmware", "fixed": [], "affected": "<= 2.056b06", "ecosystem": "vendor"}, {"name": "dlink dir-809 firmware", "fixed": [], "affected": "<= 1.04b02", "ecosystem": "vendor"}, {"name": "dlink dir-900l firmware", "fixed": ["1.15b01"], "affected": "< 1.15b01", "ecosystem": "vendor"}, {"name": "dlink dir-501 firmware", "fixed": [], "affected": "<= 1.01b04", "ecosystem": "vendor"}, {"name": "dlink dir-515 firmware", "fixed": [], "affected": "<= 1.01b04", "ecosystem": "vendor"}, {"name": "dlink dir-615 firmware", "fixed": [], "affected": "= 10.01b02", "ecosystem": "vendor"}, {"name": "dlink dir-615 firmware", "fixed": [], "affected": "<= 6.06b03", "ecosystem": "vendor"}, {"name": "aterm wg1900hp2 firmware", "fixed": [], "affected": "<= 1.3.1", "ecosystem": "vendor"}, {"name": "aterm wg1900hp firmware", "fixed": [], "affected": "<= 2.5.1", "ecosystem": "vendor"}, {"name": "aterm wg1800hp4 firmware", "fixed": [], "affected": "<= 1.3.1", "ecosystem": "vendor"}, {"name": "aterm wg1800hp3 firmware", "fixed": [], "affected": "<= 1.5.1", "ecosystem": "vendor"}, {"name": "aterm wg1200hs2 firmware", "fixed": [], "affected": "<= 2.5.0", "ecosystem": "vendor"}, {"name": "aterm wg1200hp3 firmware", "fixed": [], "affected": "<= 1.3.1", "ecosystem": "vendor"}, {"name": "aterm wg1200hp2 firmware", "fixed": [], "affected": "<= 2.5.0", "ecosystem": "vendor"}, {"name": "aterm w1200ex firmware", "fixed": [], "affected": "<= 1.3.1", "ecosystem": "vendor"}, {"name": "aterm w1200ex-ms firmware", "fixed": [], "affected": "<= 1.3.1", "ecosystem": "vendor"}, {"name": "aterm wg1200hs firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "aterm wg1200hp firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "aterm wf800hp firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "aterm wf300hp2 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "aterm wr8165n firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "aterm w500p firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "aterm w300p firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "infrastructure", "iot-devices", "miniigd", "realtek-sdk", "routers"] not_affected_if: ["miniigd-disabled", "no-realtek-sdk-firmware"] published_at: "2015-05-01T15:59:01+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-23T22:29:04+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-8361", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8361", "first_seen_at": "2026-10-23T22:29:04+00:00"}] --- # The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted… Realtek SDK's miniigd SOAP service does not validate input in the NewInternalClient request, so a remote attacker can send a crafted request to run malicious code on the device. CISA lists it as actively exploited in the wild. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Realtek SDK affected ? fixed ? - vendor:dlink dir-905l firmware affected <= 2.05b01 fixed ? - vendor:dlink dir-605l firmware affected <= 1.14b06 fixed ? - vendor:dlink dir-600l firmware affected <= 1.15 fixed ? - vendor:dlink dir-619l firmware affected <= 1.15 fixed ? - vendor:dlink dir-619l firmware affected <= 2.07b02 fixed ? - vendor:dlink dir-605l firmware affected <= 2.07b02 fixed ? - vendor:dlink dir-605l firmware affected <= 3.03b07 fixed ? - vendor:dlink dir-600l firmware affected <= 2.056b06 fixed ? - vendor:dlink dir-809 firmware affected <= 1.04b02 fixed ? - vendor:dlink dir-900l firmware affected < 1.15b01 fixed 1.15b01 - vendor:dlink dir-501 firmware affected <= 1.01b04 fixed ? - vendor:dlink dir-515 firmware affected <= 1.01b04 fixed ? - vendor:dlink dir-615 firmware affected = 10.01b02 fixed ? - vendor:dlink dir-615 firmware affected <= 6.06b03 fixed ? - vendor:aterm wg1900hp2 firmware affected <= 1.3.1 fixed ? - vendor:aterm wg1900hp firmware affected <= 2.5.1 fixed ? - vendor:aterm wg1800hp4 firmware affected <= 1.3.1 fixed ? - vendor:aterm wg1800hp3 firmware affected <= 1.5.1 fixed ? - vendor:aterm wg1200hs2 firmware affected <= 2.5.0 fixed ? - vendor:aterm wg1200hp3 firmware affected <= 1.3.1 fixed ? - vendor:aterm wg1200hp2 firmware affected <= 2.5.0 fixed ? - vendor:aterm w1200ex firmware affected <= 1.3.1 fixed ? - vendor:aterm w1200ex-ms firmware affected <= 1.3.1 fixed ? - vendor:aterm wg1200hs firmware affected ? fixed ? - vendor:aterm wg1200hp firmware affected ? fixed ? - vendor:aterm wf800hp firmware affected ? fixed ? - vendor:aterm wf300hp2 firmware affected ? fixed ? - vendor:aterm wr8165n firmware affected ? fixed ? - vendor:aterm w500p firmware affected ? fixed ? - vendor:aterm w300p firmware affected ? fixed ? ## Fix Apply the vendor mitigation per CISA's required action, or stop using the affected product. Affected firmware versions are unknown from the sources. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-8361 - 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2014-8361 ## From the sources Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_