Realtek rtl81xx SDK 1030.38.712.2019 MgntActSet_TEREDO_SET_RS_PACKET heap-based overflow

Summaryinfo

A vulnerability was found in Realtek rtl81xx SDK 1030.38.712.2019. It has been declared as critical. Affected is the function MgntActSet_TEREDO_SET_RS_PACKET. Such manipulation leads to heap-based overflow. This vulnerability is traded as CVE-2025-8299. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability was found in Realtek rtl81xx SDK 1030.38.712.2019. It has been rated as critical. Affected by this issue is the function MgntActSet_TEREDO_SET_RS_PACKET. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. CVE summarizes:

Realtek rtl81xx SDK Wi-Fi Driver MgntActSet_TEREDO_SET_RS_PACKET Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek rtl81xx SDK Wi-Fi driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the MgntActSet_TEREDO_SET_RS_PACKET function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-25857.

The advisory is shared for download at zerodayinitiative.com. This vulnerability is handled as CVE-2025-8299 since 07/29/2025. The exploitation is known to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/03/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Realtek

Name

• rtl81xx SDK

Version

• 1030.38.712.2019

License

• commercial

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion