Researchers at Nozomi Networks have detected a significant increase in exploitation attempts targeting CVE-2021-35394, a critical vulnerability in the Realtek Jungle SDK. The flaw carries a CVSS score of 9.8 and enables unauthenticated remote code execution on affected devices.
Activity surged beginning 5 September, with attackers using the vulnerability to install the Cling botnet on routers and video recorders. The SDK is widely used across multiple hardware manufacturers, amplifying the impact because many consumer and small-office devices receive firmware updates infrequently or never.
Cling does not rely solely on the Realtek flaw. The malware includes exploits for seven separate vulnerabilities affecting products from Realtek, Linksys, MVPower, TBK, LB-LINK, FiberHome and China Mobile. After infection, the botnet performs recursive network scanning and propagates in a worm-like manner.
Additional capabilities include opening and closing TCP tunnels, enabling and disabling proxies, and participating in distributed denial-of-service attacks. The most notable feature is its command-and-control mechanism, which conceals instructions inside the transaction ID field of the STUN protocol. Traffic is crafted to resemble legitimate responses from Google public STUN servers, allowing C2 communications to blend with ordinary video-call traffic.
FortiGuard Labs at Fortinet has independently verified the campaign and tracks the variant under the name ClingSTUN. The incident underscores how long-unpatched vulnerabilities in network equipment continue to be leveraged by threat actors.
