CVE-2021-35394Vulnerability
Realtek Jungle SDK Remote Code Execution Vulnerability
Reported by 2 independent sources · first reported by The Hacker News · last reported
Last reported 19 days ago
Fix due 24 Dec 2021
Used by ransomware: not knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 7 Oct 2026
What the reports say
2 reports, newest first · the exact sentence from each-
ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure“…he attacker spread the malware “ClingSTUN” via several IoT command injections targeting multiple devices, including Linear, Realtek (CVE-2021-35394), TP-Link Archer AX21 (CVE-2023-1389), AVTECH AVM1203 (CVE-2024-7029), and D-Link (CVE-2024-10915).”
-
Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2“The operational technology (OT) security company said it observed a spike in attempts to exploit CVE-2021-35394 (CVSS score: 9.8), a critical remote code execution (RCE) flaw in Realtek Jungle SDK starting around September 5, 2026, with a subset of the activity delivering Cling.”
Indicators reported together
named in the same reports- c1d8e2829ea63b9d…78e908e0e6e8in 1 report
- e6e113783356446a…76f095a95c4cin 1 report
- 145.249.115[.]184in 1 report
- 112.151.157[.]222in 1 report
- 192.170.240[.]137in 1 report
- 23.81.40[.]193in 1 report
- 147.185.221[.]129in 1 report
Copy these 7 indicators · defanged
Also named with it: CVE-2016-20016, CVE-2014-8361, CVE-2023-26801, CVE-2023-41011, CVE-2024-3721, CVE-2025-34037, CVE-2025-67038, CVE-2024-21887, CVE-2023-46805, CVE-2022-37055, CVE-2023-1389, CVE-2024-10914, CVE-2016-10372
Thanks — we review every report.