Cling Botnet Exploits Realtek Jungle SDK Vulnerability

• •CVE-2021-35394 is a critical RCE vulnerability in Realtek Jungle SDK.
• •Cling botnet exploits STUN traffic for covert command-and-control operations.
• •Active exploitation attempts began in early September 2026, despite the patch being available.

Threat actors are exploiting a critical vulnerability (CVE-2021-35394) in the Realtek Jungle SDK to deploy a botnet malware named Cling. This malware utilizes STUN traffic to create a covert command-and-control channel, allowing it to blend in with legitimate network activity. The vulnerability, which has a CVSS score of 9.8, affects versions v2.x to v3.4.14B of the SDK, widely used in IoT devices and routers. Exploitation attempts began around September 5, 2026, with the malware embedding exploit logic for multiple other vulnerabilities in routers and DVRs. The Cling botnet can achieve persistence on infected systems by modifying system files and replacing legitimate binaries. As of October 5, 2026, the vulnerability has been patched, but attempts have been observed.