CVE-2021-35393

CVE-2021-35393 is a critical stack buffer overflow vulnerability in Realtek Jungle SDK versions up to v3.4.14B, specifically within the 'WiFi Simple Config' server (wscd or mini_upnpd). This flaw, stemming from unsafe parsing of UPnP SUBSCRIBE/UNSUBSCRIBE Callback headers, allows unauthenticated remote attackers to achieve arbitrary code execution on affected devices. With a CVSS score of 9.8 (Critical), it presents a severe risk due to its network-based attack vector, low complexity, and complete compromise potential. Although no public exploit code is listed for Metasploit, Nuclei, or ExploitDB, media reports and community discussions confirm active exploitation shortly after disclosure, indicating a high level of attacker interest.