Technical intelligence and weaponization dossier for CVE-2014-8361. Documented exploitation across 1 active malware families totaling 1 analyzed telemetry samples.
| Vulnerability ID | CVE-2014-8361 |
|---|---|
| Common Name / Bulletin | Realtek SDK Miniigd SOAP Service Command Injection (Mirai Botnet) (Realtek Advisory) |
| CWE Classification | CWE-78: OS Command Injection in miniigd UPnP |
| Affected Software & Versions | Realtek RTL819xD router SDK miniigd SOAP service |
| Technical Root Cause | SOAP service in miniigd UPnP daemon accepted unsanitized NewInternalClient inputs via NTP synchronization commands, enabling remote shell execution on IoT routers. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2014-8361 in enterprise networks:
HTTP POST requests to TCP port 52869 containing SOAP action 'urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping' with shell metacharacters (` ` or $( )).SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Botnet Protection & Remediation →