CVE-2014-8361: Realtek SDK Improper Input Validation Vulnerability

Q: How do I fix CVE-2014-8361?

dir-905l firmware: upgrade to newer than 2.05b01; dir-605l firmware: upgrade to newer than 3.03b07; dir-600l firmware: upgrade to newer than 2.056b06. Exact commands for each OS are on this page.

Q: Is CVE-2014-8361 being exploited?

Yes. CVE-2014-8361 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

Q: What does CVE-2014-8361 affect?

CVE-2014-8361 affects dir-905l firmware, dir-605l firmware, dir-600l firmware. Severity is critical (CVSS 9.8). The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.

Q: How urgent is CVE-2014-8361?

Priority 97/100. Critical severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Patch now

CRITICAL 9.8EXPLOITEDREMOTEUPGRADEUPGRADEUPGRADE

CVE-2014-8361 is a critical-severity flaw (CVSS 9.8) affecting dir-905l firmware, dir-605l firmware, dir-600l firmware, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.

Why this priority

Critical severity
EPSS top 1%: very likely to be exploited
Exploited in the wild (CISA KEV)
Public exploit reference
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	100.0% (top 1%)
CISA exploited list	Yes, fix due 2023-10-09
Published	2015-05-01
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: dlink

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2015-05-01 15:59 UTCPublished CVE record published
2023-09-18Exploited Added to the CISA Known Exploited Vulnerabilities list
2023-10-09Deadline CISA due date for US federal agencies to patch
2026-06-17 00:16 UTCUpdated Record last modified

dlink dir-905l firmware UPGRADE

Affected: <= 2.05b01

Fixed in: newer than 2.05b01

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

dlink dir-605l firmware UPGRADE

Affected: <= 1.14b06 · <= 2.07b02 · <= 3.03b07

Fixed in: newer than 3.03b07

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

dlink dir-600l firmware UPGRADE

Affected: <= 1.15 · <= 2.056b06

Fixed in: newer than 2.056b06

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

dlink dir-619l firmware UPGRADE

Affected: <= 1.15 · <= 2.07b02

Fixed in: newer than 2.07b02

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

dlink dir-809 firmware UPGRADE

Affected: <= 1.04b02

Fixed in: newer than 1.04b02

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

dlink dir-900l firmware UPGRADE

Affected: < 1.15b01

Fixed in: 1.15b01

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

Exact fixes by distribution

Fedora 46 · perl-Net-IDN-Encode · FIXED · 2.600-1.fc46 · FEDORA-2026-84eff0ea64 · source

sudo dnf upgrade --advisory=FEDORA-2026-84eff0ea64

Fedora ELN · libXISF · FIXED · 0.2.15-2.eln159 · FEDORA-2026-b9e2d1bda0 · source

sudo dnf upgrade --advisory=FEDORA-2026-b9e2d1bda0

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: krevetkqqq/CVE-2014-8361 (0 stars)
Write-up: www.exploit-db.com/exploits/37169/
Exploit-DB: Realtek SDK - Miniigd UPnP SOAP Command Execution (Metasploit)
Metasploit: D-Link Devices UPnP SOAP Command Execution
Metasploit: Realtek SDK Miniigd UPnP SOAP Command Execution

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2014-8361?

dir-905l firmware: upgrade to newer than 2.05b01; dir-605l firmware: upgrade to newer than 3.03b07; dir-600l firmware: upgrade to newer than 2.056b06. Exact commands for each OS are on this page.

Is CVE-2014-8361 being exploited?

Yes. CVE-2014-8361 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2014-8361 affect?

CVE-2014-8361 affects dir-905l firmware, dir-605l firmware, dir-600l firmware. Severity is critical (CVSS 9.8). The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.

How urgent is CVE-2014-8361?

Priority 97/100. Critical severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

References

← Back to latest CVEs