Critical
KEV-listed
CVE-2021-35394
ClingSTUN Botnet Exploits Multiple IoT Vulnerabilities via STUN Protocol
Vendor / product: Realtek Jungle SDK, Hytec Inter HWL-2511-SS
Public PoC: Yes
First tracked by RiskWire: 2026-10-07
CISA KEV catalog
Added to KEV
Federal remediation due
2021-12-24 (1748 days overdue)
Ransomware campaign use
Unknown
CISA description
RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.
Required action
Apply updates per vendor instructions.
Sources & citations (22)
- ClingSTUN : le malware Linux qui crée des relais proxy neoteo.com · 2026-10-07
- Cling: IoT Backdoor Disguises C2 as STUN Traffic dev.to · 2026-10-06
- Cling Botnet Encodes C2 Commands in STUN Traffic to Evade Network Detection cyberpress.org · 2026-10-06
- ClingSTUN proxy malware turns devices into relays neoteo.com · 2026-10-07
- ClingSTUN: el malware proxy que explota Linux neoteo.com · 2026-10-07
- ClingSTUN: złośliwe proxy wykorzystuje sprzęt z Linuksem neoteo.com · 2026-10-07
- ClingSTUN: il malware Linux che crea nodi proxy neoteo.com · 2026-10-07
- Linux後門ClingSTUN利用公開STUN服務，惡意通訊更難辨識 ithome.com.tw · 2026-10-07
- ClingSTUN: Linux-Malware macht Geräte zu Proxy-Knoten neoteo.com · 2026-10-07
- ClingSTUN превращает уязвимые IoT-устройства в прокси-узлы cisoclub.ru · 2026-10-06
- ClingSTUN спрятал Linux-бэкдор среди обычного трафика VoIP и WebRTC securitylab.ru · 2026-10-06
- Cling Botnet Spoofs Google STUN Traffic to Hide Commands Sent to Infected IoT Devices gbhackers.com · 2026-10-06
- ClingSTUN Linux backdoor: public STUN mapping neoteo.com · 2026-10-06
- ClingSTUN: backdoor dla Linuksa wykorzystuje STUN neoteo.com · 2026-10-06
- FortiGuard Lab poinformowało o wykryciu backdoora w systemie Linux, nazwanego ClingSTUN, który przekształca zainfekowane systemy w serwery proxy wykorzystujące protokół STUN (Session Traversal Utilities for NAT) oraz mecha.. poland.news-pravda.com · 2026-10-06
- ClingSTUN botnet hijacks devices with years-old flaws itnews.com.au · 2026-10-07
- ClingSTUN: FortiGuard erklärt die Linux-Backdoor neoteo.com · 2026-10-06
- ClingSTUN: puerta trasera Linux que usa STUN público neoteo.com · 2026-10-06
- ClingSTUN: Linux-backdoor maakt apparaten tot proxy's neoteo.com · 2026-10-07
- ClingSTUN, la backdoor Linux analizzata da FortiGuard neoteo.com · 2026-10-06
+2 more sources
References
See CVE-2021-35394 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →