Realtek vulnerabilities
78 vulnerabilities
Known vulnerabilities in Realtek products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 57 products.
Products
50 of 57- Rtl819X Jungle Software Development Kit23 vulnerabilities
- Rtl819X Jungle SDK19 vulnerabilities
- Rtl8195A7 vulnerabilities
- Wi Fi Usb Driver5 vulnerabilities
- Bluetooth Mesh Software Development Kit4 vulnerabilities
- Linux/Android Bluetooth Mesh SDK4 vulnerabilities
- Rtl8195Am4 vulnerabilities
- Rtsper4 vulnerabilities
- Rtsuer4 vulnerabilities
- Rtsupx Usb Utility Driver4 vulnerabilities
- Rtl81Xx SDK3 vulnerabilities
- Hd Audio Codec Drivers2 vulnerabilities
- Rtk 11N Ap2 vulnerabilities
- Rtl8111Fp Cg2 vulnerabilities
- Rtl8710C2 vulnerabilities
- Rtl8762E Software Development Kit2 vulnerabilities
- Rtl8811Au2 vulnerabilities
- Adsl Router Soc1 vulnerabilities
- Audio Driver1 vulnerabilities
- Bluetooth HCI Adaptor1 vulnerabilities
- Ecos Msdk1 vulnerabilities
- Ecos Rsdk1 vulnerabilities
- GPON Router1 vulnerabilities
- Hda Driver1 vulnerabilities
- Ndis1 vulnerabilities
- Realtek Andrea RT Filters1 vulnerabilities
- Realtek Audio Service1 vulnerabilities
- Realtek High Definition Audio Driver1 vulnerabilities
- Realtek Media Player1 vulnerabilities
- Realtek Sdk1 vulnerabilities
- RTK IIS Codec Service1 vulnerabilities
- Rtl8111Ep Cg1 vulnerabilities
- Rtl8152B1 vulnerabilities
- Rtl81531 vulnerabilities
- Rtl8153B1 vulnerabilities
- Rtl81541 vulnerabilities
- Rtl8154B1 vulnerabilities
- Rtl81561 vulnerabilities
- Rtl8156B1 vulnerabilities
- Rtl8192Er1 vulnerabilities
- Rtl8196D1 vulnerabilities
- Rtl819X Software Development Kit1 vulnerabilities
- Rtl8710Af1 vulnerabilities
- Rtl8711Af1 vulnerabilities
- Rtl8711Am1 vulnerabilities
- Rtl8723De1 vulnerabilities
- Rtl8812Ar1 vulnerabilities
- Rtl8812Au1 vulnerabilities
- Rtl8881An1 vulnerabilities
- USB Fe/1Gbe/2.5Gbe/5Gbe NIC Family1 vulnerabilities
CVE-2021-36925realtekrtsupx_usb_utility_driver
EPSS score0.28%
RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve an arbitrary read or write operation from/to physical memory (leading to Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device.CVE-2021-36924realtekrtsupx_usb_utility_driverEPSS score0.21%
RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve a pool overflow (leading to Escalation of Privileges, Denial of Service, and Code Execution) via a crafted Device IO Control packet to a device.CVE-2021-36922realtekrtsupx_usb_utility_driverEPSS score0.28%
RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB devices (Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device.CVE-2021-36923realtekrtsupx_usb_utility_driverEPSS score0.28%
RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB device privileged IN and OUT instructions (leading to Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device.CVE-2021-39306realtekrtl8195am_firmwareEPSS score1.31%
A stack buffer overflow was discovered on Realtek RTL8195AM device before 2.0.10, it exists in the client code when an attacker sends a big size Authentication challenge text in WEP security.CVE-2021-43573realtekrtl8195am_firmwareEPSS score1.10%
A buffer overflow was discovered on Realtek RTL8195AM devices before 2.0.10. It exists in the client code when processing a malformed IE length of HT capability information in the Beacon and Association response frame.CVE-2021-27372realtekxpon_rtl9601d_software_development_kitEPSS score1.70%
Realtek xPON RTL9601D SDK 1.9 stores passwords in plaintext which may allow attackers to possibly gain access to the device with root permissions via the build-in network monitoring tool and execute arbitrary commands.CVE-2021-32537realtekhda_driverEPSS score0.44%
Realtek HAD contains a driver crashed vulnerability which allows local side attackers to send a special string to the kernel driver in a user’s mode. Due to unexpected commands, the kernel driver will cause the system crashed.CVE-2021-35394realtekrtl819x_jungle_software_development_kitKEVEPSS score99.88%
Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.CVE-2021-35395realtekrtl819x_jungle_software_development_kitKEVEPSS score98.10%
Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface exists: one based on Go-Ahead named webs and another based on Boa named boa. Both of them are affected by these vulnerabilities. Specifically, these binaries are vulnerable to the following issues: - stack buffer overflow in formRebootCheck due to unsafe copy of submit-url parameter - stack buffer overflow in formWsc due to unsafe copy of submit-url parameter - stack buffer overflow in formWlanMultipleAP due to unsafe copy of submit-url parameter - stack buffer overflow in formWlSiteSurvey due to unsafe copy of ifname parameter - stack buffer overflow in formStaticDHCP due to unsafe copy of hostname parameter - stack buffer overflow in formWsc due to unsafe copy of 'peerPin' parameter - arbitrary command execution in formSysCmd via the sysCmd parameter - arbitrary command injection in formWsc via the 'peerPin' parameter Exploitability of identified issues will differ based on what the end vendor/manufacturer did with the Realtek SDK webserver. Some vendors use it as-is, others add their own authentication implementation, some kept all the features from the server, some remove some of them, some inserted their own set of features. However, given that Realtek SDK implementation is full of insecure calls and that developers tends to re-use those examples in their custom code, any binary based on Realtek SDK webserver will probably contains its own set of issues on top of the Realtek ones (if kept). Successful exploitation of these issues allows remote attackers to gain arbitrary code execution on the device.CVE-2021-35393realtekrtl819x_jungle_software_development_kitEPSS score68.30%
Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or mini_upnpd and is the successor to miniigd. The server is vulnerable to a stack buffer overflow vulnerability that is present due to unsafe parsing of the UPnP SUBSCRIBE/UNSUBSCRIBE Callback header. Successful exploitation of this vulnerability allows remote unauthenticated attackers to gain arbitrary code execution on the affected device.CVE-2021-35392realtekrtl819x_jungle_software_development_kitEPSS score83.15%
Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or mini_upnpd and is the successor to miniigd. The server is vulnerable to a heap buffer overflow that is present due to unsafe crafting of SSDP NOTIFY messages from received M-SEARCH messages ST header.CVE-2016-20085realtekrealtek high definition audio driverEPSS score0.17%
Realtek High Definition Audio Driver 6.0.1.6730 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by placing a malicious executable in the service path. Attackers can insert an executable file in the unquoted path and restart the service to execute code with LocalSystem privileges.CVE-2025-44531realtekrtl8762e_software_development_kitEPSS score0.46%
An issue in Realtek RTL8762EKF-EVB RTL8762E SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted before a pairing public key is received during a Bluetooth connection attempt.CVE-2025-44526realtekrtl8762e_software_development_kitEPSS score0.33%
Realtek RTL8762EKF-EVB RTL8762E SDK V1.4.0 was discovered to utilize insufficient permission checks on critical fields within Bluetooth Low Energy (BLE) data packets. This issue allows attackers to cause a Denial of Service (DoS) via a crafted LL_Length_Req packet.CVE-2025-8300realtekrtl81xx sdk+1EPSS score0.15%
Realtek rtl81xx SDK Wi-Fi Driver rtwlanu Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek rtl81xx SDK Wi-Fi driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the N6CSet_DOT11_CIPHER_DEFAULT_KEY function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26552.CVE-2025-8301realtekrtl8811au+1EPSS score0.15%
Realtek RTL8811AU rtwlanu.sys N6CSet_DOT11_CIPHER_DEFAULT_KEY Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek RTL8811AU drivers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the N6CSet_DOT11_CIPHER_DEFAULT_KEY function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-24786.CVE-2025-8302realtekrtl81xx sdk+1EPSS score0.15%
Realtek rtl81xx SDK Wi-Fi Driver rtwlanu Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek rtl81xx SDK Wi-Fi driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the N6CSet_DOT11_CIPHER_DEFAULT_KEY function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26553.CVE-2025-8298realtekrtl8811au+1EPSS score0.14%
Realtek RTL8811AU rtwlanu.sys N6CQueryInformationHandleCustomized11nOids Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of Realtek RTL8811AU drivers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the N6CQueryInformationHandleCustomized11nOids function. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-25864.CVE-2025-8299realtekrtl81xx sdk+1EPSS score0.15%
Realtek rtl81xx SDK Wi-Fi Driver MgntActSet_TEREDO_SET_RS_PACKET Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek rtl81xx SDK Wi-Fi driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the MgntActSet_TEREDO_SET_RS_PACKET function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-25857.