Affected Systems

Realtek Jungle SDK (CVE-2021-35394, CVSS 9.8). Also targets routers and DVRs from Realtek, Eir, MVPower, LB-LINK, FiberHome, China Mobile, TBK, Linksys, Linear, D-Link, Sunhillo, Tenda, and Hytec via 20+ CVEs spanning 2014-2025. Primarily affects internet-facing embedded devices and OT/IoT infrastructure.

Exploitation Status

Active exploitation observed since September 5, 2026. Nozomi Networks detected spike in CVE-2021-35394 exploitation attempts delivering Cling botnet. Malware embeds exploits for 20+ vulnerabilities and propagates in worm-like fashion.

Business Impact

Cling achieves persistence via init system modification and binary replacement (wget). Uses STUN protocol traffic to blend C2 communications with legitimate NAT-traversal activity, making detection difficult. Botnet supports DDoS, TCP tunneling, proxying, and recursive scanning. Operator spoofs commands to appear from Google STUN servers (74.125.250.129), complicating attribution and blocking. Targets include ISPs, universities, and gaming servers. Organizations with unpatched Realtek SDK devices or affected routers/DVRs face immediate compromise risk.

Urgency

🔴 Immediate

Recommended Actions

  • Patch CVE-2021-35394 in Realtek Jungle SDK immediately; verify all internet-facing routers, DVRs, and IoT devices are updated or isolated
  • Block or monitor STUN traffic to suspicious servers, especially 145.249.115.184; baseline legitimate STUN usage and alert on anomalies (e.g., all-zero transaction IDs, non-standard registration messages)
  • Hunt for persistence indicators: check /etc/inittab, /etc/init.d/rcS, /etc/rc.d/rc.boot for /root/.cling or /usr/local/bin/.cling; verify wget binary integrity
  • Review firewall rules to restrict outbound UDP traffic from embedded devices to known-good STUN servers only; consider denying access to the 13 hard-coded STUN IPs if not operationally required
  • Deploy network behavior analytics to detect devices sending STUN Binding Requests every ~5 seconds or UDP traffic to port 33957; correlate with CVE-2021-35394 exploit signatures in IDS/IPS logs