Realtek AP-Router SDK vulnerabilities could impact millions of routers and IoT devices

Realtek SDK vulnerabilities

The IoT Inspector Research Lab has discovered four high and critical vulnerabilities in the Realtek AP-Router “Jungle” SDK used for RTL819x SoCs that could impact millions of WiFi routers and dongles. An attacker can use a network attack, e.g. without physical access to the device, to generate a buffer or stack overflow helping him access the system and execute his own code. Realtek has released an advisory (PDF) with patchsets for all four vulnerabilities so you should upgrade the firmware if you can. Summary of the four vulnerabilities: CVE-2021-35392 – Realtek Jungle SDK version v2.x up to v3.4.14B provides a ‘WiFi Simple Config’ server called wscd or mini_upnpd that implements both UPnP and SSDP protocols. The server is vulnerable to a heap buffer overflow that is present due to unsafe crafting of SSDP NOTIFY messages from received M-SEARCH messages ST header. CVE-2021-35393 – Also impacts ‘WiFi Simple Config’ server (wscd […]

$6 Rtlduino RTL8720DN dual-band WiFi IoT board features 2.4/5GHz Wireless MCU

There are plenty of WiFi modules for the IoT market, but those usually work at 2.4 GHz only. This may be an issue in areas where the 2.4 GHz spectrum is overcrowded. But two years ago, we were pleased to see the Ameba Z2  board offering dual-band (2.4GHz and 5Ghz) WiFi thanks to Realtek RTL8720CM wireless MCU, and last year, we discovered B&T BW16 dual-band IoT module based on RTL8720DN sold for under $4 before shipping. If you like the cheap price of the module, but do not feel like creating your own baseboard, or soldering wires to the module, you’ll be glad to know Rtlduino RTL8720DN board offers an easy way to evaluate RTL8720DN dual-band WiFi (and Bluetooth LE 5.0) microcontroller as it is fitted with a B&T BW16 module and comes in a form factor similar to NodeMCU ESP8266 board. Rtlduino RTL8720DN board Specifications: B&T BW16 wireless module […]

Ameba Z2 IoT Board Features Realtek RTL8720CM Armv8-M KM4 Secure Wireless MCU

In 2016 we discovered Realtek Ameba wireless microcontrollers combining an Arm Cortex-M3 core with WiFi connectivity, and that could potentially become an ESP8266 competitor with modules selling for as low as $2. But the solution never really took off, because it was about the same price as ESP8266, and the latter already had a solid software ecosystem and community. But RealTek has now introduced a new Ameba Z2 IoT development board powered by RTL8720CM microcontroller featuring an Armv8-M KM4 core clocked at 100 MHz. What’s an Arm KM4 core you may ask? Seeed Studio informed me Arm and RealTek worked together on the KM4 core, so it looks like a custom Armv8-M microcontroller. Ameba Z2 IoT Development Board Ameba Z2 (ZII) specifications: Wireless MCU – Realtek RTL8720CM single core Armv8-M KM4 core @ 100MHz with 4.2MB internal RAM, WiFi and Bluetooth radios Storage – 2MB external flash on module Connectivity […]

VIP1111 TV Box is Powered by Realtek RTD1395 Processor

A few days ago, the U-boot & Linux source code for Realtek RTD1296 processor was released, and when we checked out the code we found out references to a completely new Realtek RTD1619 hexa-core Arm Cortex-A55 processor, as well as code for the previously announced Realtek RTD1395 processor. The CES 2018 announcement was really short on details though: “Realtek’s Android & RDK STB platform (RTD1395) supports 4K UHD, HDR, an advanced DRM security system, and OTT integration, giving MSOs a reliable SoC partner”.  We now have more details thanks to Taiwan based Compal Broadband Networks and their VIP1111 4K IP set-top box powered by RTD1395 processor.VIP1111 TV box specifications: SoC – Realtek RTD1395 quad core Cortex-A53 processor, Arm Mali-470 MP4 GPU System Memory – 2GB DDR4 (4x 512MB x 16bit) Storage – 8GB  eMMC Flash Video & Audio Output – HDMI 2.0 Video Codec – HEVC 4Kp60+2Kp60, VP9.2 4Kp60, HDR10 […]

Realtek RTD1296 STB/Media NAS SoC Coming Soon with Multiple Ethernet Ports, Dual SATA, HDMI 2.0 Input and Output

I have reviewed several Realtek RTD1295 TV boxes with NAS and HDMI input functions such as Zidoo X9S and EWEAT R9 Plus, and those were quite capable devices with a rich feature set, but Realtek has been working on a new higher-end RTD1296 SoC for quite some time. It comes with the same CPU and GPU, but has a larger package with more peripheral interfaces. I received the screenshot above last December, but the information does not seem to have changed since then. Realtek RTD1296 is equipped with a quad core Cortex A53 processor, an ARM Mali-T820MP3 GPU, and the same H.265/VP9 video engine as RTD1295. However, the new SoC adds one extra RGMII (Gigabit Ethernet) interface, one more USB 3.0 port, one extra SATA interface, and offers higher DDR bandwidth. The PCIe interface would also allow you to use more than just two SATA drives. Charbax got in touch […]

How to Reinstall Android Firmware on Realtek RTD1295 TV Boxes

I started playing with Beelink SEA I TV box nearly two weeks ago, but I soon realized there was a big problem, while I could get an IP address with both Ethernet or WiFi, I could not access Internet, nor the local network with the box, and even ping would not work. So I contact Beelink to find a solution, and they believed I may have a problem with the firmware on my box, and recommended to re-flash it. Great. I asked the firmware, and the company eventually provided me with two files: SEAI_101M0_32G_20170225.img (password: 879y) SEAI_101M0_16G_20170225.img (password: 2js2) Those are baidu link which may be slow to download outside of China, so the company also provided a mirror later. The customer representative told me those were “Lines brushes Pack” firmware, and after lots of email back and forth. I finally got proper instructions which should work for Beelink SEA […]

Realtek RTD1295 SoC and Zidoo X9S TV Box Patchsets for Initial Mainline Linux Support

Realtek RTD1295 is a quad core Cortex A53 processor with built-in Gigabit Ethernet, USB 3.0 and SATA found, and is found in some TV boxes such as Zidoo X9S or Eweat R9 Plus that run Android 6.0 and OpenWrt on top of Linux 4.1. Andreas Färber has been working on Mainline Linux support for the SoC using Zidoo X9S, and just submitted patchsets for enablement of RTD1295. Andreas explains: This mini-series adds initial support for the Realtek RTD1295 SoC and the Zidoo X9S TV box. With these patches CPU0 can be booted with earlycon. PSCI doesn’t work despite present in the vendor device tree; as enable-method it instead used a custom “rtk-spin-table” that I sadly have no source code of. The UARTs use a custom interrupt controller that I again lack source code of; with interrupts = <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH> it can boot into an initrd. The boot process is […]

RTL8710 Ameba Arduino Development Board and Ameba Arduino v2.0.0 SDK Released

We’ve already seen a NodeMCU lookalike board called RTLDuino based on Realtek RTL8710AF ARM Cortex M3 WiSoC earlier this month, that can be programmed with a community supported Arduino port also called rtlduino via a JLink SWD debugger, but now Realtek has just launched Ameba RTL8710 Arduino board, and released Ameba Arduino v2.0.0 SDK which brings official Arduino support to RTL8710AF platforms. There appears to be two versions of the development kit: RTLDUINO_PRO_V1.0 and REALTEK-AMEBA_RTL8710_V2.0, but based on the user manual they seem to be identical, and as you can see from the above picture, it includes a baseboard and the aforementioned RTLDuino board. RTL8710 Ameba Arduino HDK key features: SoC – Realtek RTL8710AF ARM Cortex-M3 MCU @ 83 MHz with 802.11 b/g/n WiFi, hardware SSL engine connected to the baseboard via: RTLDuino board through female header B&T RTL-00 module soldered on module footprint USB – 2x micro USB ports, […]