CVE-2014-8361

Confirmed PUBLISHED

The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in...

Realtek · SDK

Exploited in the wild Active exploitation observed PoC available

Recommended Action

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Active exploitation observed

Observed in Sensors

Yes

Attempts (30d)

Unique Attacker IPs

CISA KEV

In CISA KEV

CVSS / EPSS

9.8 Critical EPSS 100.0%

At a Glance

The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.

windows metasploit cisa

CVE Published: May 01, 2015
Exploitation Reported: Sep 18, 2023
CVSS: 9.8 Critical
EPSS: 100.0%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
n/a	n/a	n/a	Affected

CVE References

JVN#47580234 jvn.jp · Third-Party Advisory http://jvn.jp/en/jp/JVN47580234/index.html
JVN#67456944 jvn.jp · Third-Party Advisory http://jvn.jp/en/jp/JVN67456944/index.html
37169 exploit-db.com · Exploit https://www.exploit-db.com/exploits/37169/
74330 securityfocus.com · VDB Entry http://www.securityfocus.com/bid/74330
zerodayinitiative.com/advisories/ZDI-15-155 zerodayinitiative.com · CVE Record http://www.zerodayinitiative.com/advisories/ZDI-15-155/

Show 4 more references

securityadvisories.dlink.com/security/publication.aspx securityadvisories.dlink.com · CVE Record http://securityadvisories.dlink.com/security/publication.aspx?name=SA...
packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-C... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-...
sensorstechforum.com/hinatabot-cve-2014-8361-ddos sensorstechforum.com · CVE Record https://sensorstechforum.com/hinatabot-cve-2014-8361-ddos/
web.archive.org/web/20150909230440/http://securityadvisories... web.archive.org · CVE Record https://web.archive.org/web/20150909230440/http://securityadvisories....

Recommended Actions

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.
Review sensor telemetry for request paths, attacker IPs, and payload patterns that may inform detection and exposure validation.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2023-09-18 00:00 UTC
The Shadowserver	2026-06-01 00:00 UTC
KEVIntel	2026-07-06 08:25 UTC

Operational indicators for this CVE are listed on the Detection tab.

Indicators of Compromise (IoCs)

Attacker IP IoCs observed in KEVIntel sensors are available to Pro and Enterprise accounts on the Detection tab and through the Pro API.

Learn about Pro API access

Observed Detection Signals (30d)

Aggregate counts from KEVIntel sensor telemetry for this CVE.

Distinct request paths: 5
Distinct User-Agents: 4

The specific request paths and User-Agents attackers are using are available on Pro and Enterprise plans.

Request Enterprise Access Compare plans Create free account

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/realtek_miniigd_upnp_exec_noauth.rb	Apr 29, 2025

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 10.0 High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitation Status

Exploited in the wild

Recorded 2023-09-18 00:00:00 UTC · CISA

Active exploitation observed

Recorded 2026-06-27 01:44:44 UTC · KEVIntel sensor

Proof of concept available

Recorded 2025-04-28 15:02:06 UTC

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/realtek_miniigd_upnp_exec_noauth.rb	Apr 29, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

realtek_miniigd_upnp_exec_noauth

metasploit · Created Unknown

Metasploit module for CVE-2014-8361

dlink_upnp_exec_noauth

metasploit · Created Unknown

Metasploit module for CVE-2014-8361

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

27 Jun 2026 01:44 UTC 22 days ago

27 Jun 2026 01:44 UTC · 22 days ago

Observed by KEVIntel sensors

Evidence-backed exploitation signal
27 Jun 2026 01:44 UTC 22 days ago

27 Jun 2026 01:44 UTC · 22 days ago

Indicators of compromise added (12)

Indicators of compromise recorded
1 Jun 2026 00:00 UTC about 2 months ago

1 Jun 2026 00:00 UTC · about 2 months ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
29 Apr 2025 10:58 UTC about 1 year ago

29 Apr 2025 10:58 UTC · about 1 year ago

Metasploit module available

Exploit module available
28 Apr 2025 15:02 UTC about 1 year ago

28 Apr 2025 15:02 UTC · about 1 year ago

Public PoC available

Public proof-of-concept code published
18 Sep 2023 00:00 UTC almost 3 years ago

18 Sep 2023 00:00 UTC · almost 3 years ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
1 May 2015 00:00 UTC about 11 years ago

1 May 2015 00:00 UTC · about 11 years ago

CVE published

Vulnerability disclosed publicly
20 Oct 2014 00:00 UTC over 11 years ago

20 Oct 2014 00:00 UTC · over 11 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2014-8361

{
  "cve_id": "CVE-2014-8361",
  "title": "The miniigd SOAP service in Realtek SDK allows remote attackers to execute ar...",
  "affected_vendor": "Realtek",
  "affected_product": "SDK",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "epss_score": 0.99975,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2014-8361

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Observed Exploitation Attempts

Exploitation Attempts Over the Last 24 Days

See more exploitation detail

Indicators of Compromise (IoCs)

Observed Detection Signals (30d)

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API