Security 1 publisher2 min readPublished Oct 5, 2026, 6:32 AM PDT

Attackers keep exploiting a five-year-old Realtek flaw to spread the Cling botnet

Nozomi Networks reports a September 5 spike in attacks exploiting CVE-2021-35394, a Realtek SDK flaw patched five years ago, to plant the Cling botnet. Its command-and-control hides inside ordinary STUN traffic, so the beacons resemble legitimate NAT traversal.

The Watch · Security desk

Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AI Send a correction

What happened

The sample carries exploit code for seven router and DVR flaws from several vendors, the oldest a 2014 Realtek SDK bug and the newest a 2025 Linksys bug.
For persistence it binds a lock on port 33957, copies itself to hidden paths, and appends startup entries to inittab and the rc init scripts used by SysV and BusyBox.
A fallback method swaps out the system wget binary and hides the original, so the malware runs whenever a legitimate process calls wget.
Operator commands let it scan and spread worm-style, open or close TCP tunnels, run or stop a proxy, and flood a chosen target for a set time.

Compiled by The WatchSomething wrong?How this is made

Why it matters

exposure The weak point is edge hardware owners never updated; the Realtek fix shipped long ago but never reached the machines still being taken over.
constraint Teams that allowlist UDP to public STUN servers now have a blind spot, since Cling's check-ins and commands ride those same servers.
precedent Turning a standard protocol's own fields into a command channel gives other botnet authors a working model that slips past signature-based detection.

STUN exists to help devices stuck behind a NAT or firewall set up direct peer-to-peer connections. ^[6] Cling turns that handshake into its control channel. The sample sends a STUN Binding Request to 13 hard-coded servers about every five seconds, sets the transaction ID to all zeros instead of the random value the specification requires, and records the public IP and ports each server reports back. ^[7] It then sends every server a custom UDP message carrying those mapped ports and a tag that records how the box was infected, such as realtek.selfrep or selfrep.router. ^[8] After that it waits, polling for UDP packets that carry operator commands inside the STUN transaction ID field. ^[9]

The custom registration messages do not conform to the STUN specification, so legitimate servers drop them. ^[10] One address in the list, 145.249.115[.]184, does not: it answers with an all-zero transaction ID rather than echoing the request, which Nozomi takes as a server built for the botnet and used to send commands back to the bots. ^[11] Because the registration goes to every server in the list, Nozomi concluded the operator needs visibility into at least one of them to track new bots and know where to send commands. ^[13]

To a monitoring tool, none of this looks wrong. "From a network monitoring perspective, the activity appears as innocuous interaction with STUN servers," Nozomi Networks said. ^[12] The company placed the significance on the method. "Cling is notable not because it introduces a new propagation technique, but because it repurposes ordinary STUN behavior into a practical command-and-control channel," Nozomi Networks said. ^[4]

What to watch

Whether exploit attempts broaden from CVE-2021-35394 to the newer embedded bugs such as the 2025 Linksys flaw.
Whether the operator-controlled STUN server at 145.249.115[.]184 gets sinkholed or pulled, cutting command delivery.
Whether new infection tags beyond realtek.selfrep and selfrep.router appear, signaling spread to other device classes.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Threat actors have been observed attempting to exploit a now-patched critical flaw in the Realtek Jungle SDK to deploy a botnet called Cling.
ReportedView cited source
[2]
CVE-2021-35394, a critical remote code execution flaw in the Realtek Jungle SDK, carries a CVSS score of 9.8.
ReportedView cited source
[3]
Nozomi Networks observed a spike in attempts to exploit CVE-2021-35394 starting around September 5, 2026, with a subset of the activity delivering Cling.
ReportedView cited source
[4]
Cling is notable not because it introduces a new propagation technique, but because it repurposes ordinary STUN behavior into a practical command-and-control channel.
ReportedSource: Nozomi Networks saidView cited source
[5]
The Cling sample embeds exploit logic for command injection and RCE flaws in routers and DVRs from multiple vendors: CVE-2014-8361 (Realtek SDK), CVE-2016-10372 (Eir D1000), CVE-2016-20016 (MVPower DVR), CVE-2023-26801 (LB-LINK), CVE-2023-41011 (FiberHome/China Mobile), CVE-2024-3721 (TBK DVR) and CVE-2025-34037 (Linksys).
ReportedView cited source
[6]
STUN (Session Traversal Utilities for NAT) is a standardized protocol that helps devices behind a NAT or firewall establish peer-to-peer real-time communications.
ReportedView cited source
[7]
Cling sends a STUN Binding Request to 13 hard-coded STUN servers roughly every 5 seconds with the transaction ID set to all zeros instead of a random value, and records the external IP and ports the servers return.
ReportedView cited source
[8]
Cling sends each server a custom UDP registration message containing the mapped ports and a tag denoting how the device was infected, such as realtek.selfrep or selfrep.router.
ReportedView cited source
[9]
The malware polls for UDP packets that encode operator commands in the STUN transaction ID field.
ReportedView cited source
[10]
The custom registration messages do not conform to the STUN protocol definition, causing legitimate STUN servers to drop the packet.
ReportedView cited source
[11]
One of the 13 servers, 145.249.115[.]184, returned an all-zero transaction ID instead of echoing the original request, which Nozomi says indicates a STUN server tailored to the bot and used to send operator commands.
ReportedView cited source
[12]
From a network monitoring perspective, the activity appears as innocuous interaction with STUN servers.
ReportedSource: Nozomi Networks saidView cited source
[13]
Because the custom registration message is sent to every STUN server in the list, Nozomi concluded the operator requires visibility into at least one of the servers to track new bots and know where to send commands.
ReportedView cited source
[14]
Cling's commands let the operator recursively scan and spread the botnet worm-like, spawn or stop a TCP tunnel, launch or stop a proxy, and run a denial-of-service attack against a target for a set duration.
ReportedView cited source
[15]
For persistence, Cling uses a single-instance check by binding a socket with SO_REUSEADDR to port 33957, copies itself to /root/.cling and /usr/local/bin/.cling, and appends both to /etc/inittab, /etc/init.d/rcS and /etc/rc.d/rc.boot to persist on SysV and BusyBox init systems.
ReportedView cited source
[16]
An alternative persistence method replaces the system wget binary with the malware after moving the original elsewhere, so the malware runs when a legitimate process invokes wget.
ReportedView cited source
[17]
CVE-2021-35394 carries a 2021 identifier and the exploitation spike came around September 2026, roughly five years later.
Derived
[18]
The sample embeds exploits for seven distinct router and DVR CVEs.
Derived

Sources

Publishers whose own reporting we read for this story.

thehackernews.com
2 articles · October 5, 2026
Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Claim ledger

Sources

Let Clarity write the post for you.