CVE-2021-35395VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2021-35395: Realtek AP-Router SDK Buffer Overflow Vulnerability

Affects Realtek AP-Router SDKSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 11/17/2021
EPSS: 98.1% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-35395 (opens in a new tab)

Description

CVE-2021-35395 is a buffer overflow vulnerability in the HTTP web server boa component of the Realtek AP-Router SDK. It arises from unsafe handling of overly long parameters submitted via web forms, which can lead to denial-of-service (DoS) conditions. This vulnerability has been exploited in the wild.

Summary

The Realtek AP-Router SDK includes an HTTP web server component called boa that improperly copies certain parameters from submitted web forms without adequate length checks. This unsafe copying results in a buffer overflow vulnerability (CWE-122) that can be triggered by sending overly long parameters. Exploitation of this flaw can cause denial-of-service (DoS) conditions on affected devices. The vulnerability is tracked as CVE-2021-35395 and has been observed in active exploitation campaigns.

Impact

Successful exploitation of this vulnerability can cause denial-of-service (DoS) on devices running the affected Realtek AP-Router SDK HTTP server, potentially disrupting network services. There is no explicit information about code execution or data compromise in the provided data.

Mitigation

No patch or official remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure of the affected HTTP server to untrusted networks.

CVE-2021-35395: Realtek AP-Router SDK Buffer Overflow Vulnerability

What to do

Description

Summary

Impact

Mitigation

Weaknesses

References

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 08:56:19 UTC

Weaknesses

References

Related threats