CVE-2021-35395: Realtek AP-Router SDK Buffer Overflow Vulnerability

CVE-2021-35395 is a buffer overflow weakness in the Realtek AP-Router SDK, specifically in the HTTP web server component known as boa. Unsafe handling of overly long parameters submitted through web forms can crash the service and produce a denial-of-service condition. Devices built on this SDK are common in consumer and small-business access points and routers; an unauthenticated or lightly authenticated attacker who can reach the management interface may disrupt availability of the network edge. Confirm exact product impact and fixed builds against the vendor advisory.

How it works

The flaw combines improper input validation (CWE-20) with a heap-based buffer overflow (CWE-122). The boa web server copies certain form parameters into fixed-size buffers without adequate length checks. When an attacker supplies values longer than those buffers can hold, memory adjacent to the buffer is overwritten. In the behavior described by CISA, the immediate result is denial-of-service: the web server process becomes unstable or terminates, taking management access and potentially other services offline. Public detail does not describe reliable remote code execution for this CVE; treat any claims of further impact as unconfirmed until verified against the vendor advisory and your own testing. Exploitation requires the ability to submit HTTP form data to the affected boa instance, which is typically exposed on the device’s LAN or, if misconfigured, on the WAN.

Am I affected? How to find it in your systems

Realtek AP-Router SDK code appears inside many white-label and OEM Wi-Fi routers, access points, and residential gateways. Inventory efforts should focus on:

• Network edge devices whose firmware or support pages mention Realtek chipsets or the boa web server.
• Management interfaces reachable on HTTP/HTTPS (commonly ports 80/443 or vendor-specific ports) that present a form-based configuration UI.
• Firmware version strings and SDK identifiers reported by the device; compare them with the versions listed in the Realtek or OEM advisory for CVE-2021-35395.
• Configuration backups, SNMP sysDescr, or banner grabs that reveal Realtek or boa strings.

Because OEMs rebrand the same SDK under many model names, do not rely solely on a “Realtek” label. Check every router and AP firmware against the vendor’s security bulletin. Telemetry signs of attempted exploitation include repeated HTTP POST requests containing unusually long parameter values aimed at form endpoints, followed by boa or httpd process crashes, unexpected device reboots, or loss of the web management service. Correlate web-server logs (if retained) with system logs showing segmentation faults or watchdog resets. Absence of such logs does not prove safety; many embedded devices keep minimal logging.

How to remediate

Patching is the primary remediation. Apply the firmware or SDK update supplied by Realtek or by the OEM that shipped your device, following the vendor’s instructions exactly as required by CISA. After updating:

• Verify the new firmware version string matches the fixed release listed in the advisory.
• Change default administrative credentials and disable remote (WAN-side) management if it is not required.
• Restrict management access to a dedicated management VLAN or to specific source addresses.
• Disable unused services and form endpoints that are not needed for daily operation.
• Re-enable logging where possible and forward logs to a central collector so future anomalies are visible.

If the OEM has not released a fix, open a support case and track their response; in parallel apply the compensating controls below.

If you can't patch immediately

Until a vendor update can be installed, reduce exposure with layered controls:

• Network segmentation: place affected devices on an isolated segment; block inbound access to their HTTP/HTTPS management ports from untrusted networks, including the internet.
• Access-control lists or firewall rules that permit management traffic only from jump hosts or administrator workstations.
• Virtual patching: if a web application firewall or reverse proxy sits in front of the device, create rules that drop or truncate POST requests whose form parameters exceed reasonable length limits.
• Disable the boa-based web UI entirely if the device can be managed via another channel (SSH, SNMP with strong credentials, or a controller) and confirm that disabling the UI does not break required functions.
• Heightened monitoring: alert on process crashes, unexpected reboots, and spikes in malformed HTTP requests destined for the device.

These measures lower the likelihood of successful DoS but do not replace the patch.

If your data may have been exposed

CISA notes that this vulnerability leads to denial-of-service; ransomware use is not documented for CVE-2021-35395. A successful attack could still coincide with broader compromise if an attacker already has foothold elsewhere, so treat any unexplained outage of an affected device as a trigger for routine incident checks—credential resets, review of adjacent systems, and verification that no unauthorized configuration changes occurred. You can run a free exposure scan of your email addresses against known breach data sets to see whether your accounts appear in unrelated third-party breaches while you complete remediation.