CVE-2023-34435 is a firmware update flaw in the boa web server of the Realtek rtl819x Jungle SDK v3.4.11, scored 7.2 High. The device does not verify an uploaded image. Realtek released a patch on 20 May 2024. Talos says LevelOne declined to patch the WBR-6013 router.
What's affected
Per Cisco Talos report TALOS-2023-1874, the affected software is Realtek rtl819x Jungle SDK v3.4.11 and the LevelOne WBR-6013 router with firmware RER4_A_v3411b_2T2R_LEV_09_170623. The flaw is in the formUpload function of the boa web server, which never checks the validity of the uploaded firmware.
The Talos report says Realtek released updated software to its customers, with a patch dated 20 May 2024. It also says LevelOne declined to patch the issue in its software. I read no vendor advisory from LevelOne, so for that router there may be no fix. Other devices built on the same SDK may also be affected, so check with each vendor.
How to check if you're exposed
Identify devices built on Realtek rtl819x chipsets and the boa web server. For a LevelOne WBR-6013, read the firmware version in the admin page and compare it with RER4_A_v3411b_2T2R_LEV_09_170623. Many other consumer and small office routers use this SDK under different brand names, so ask your suppliers.
Then check who can reach the device's web interface. The record's vector needs high privileges, which means an administrator login or equivalent, so exposure depends on who holds or can steal that login.
What to do now
- List devices that use the Realtek rtl819x SDK and ask each vendor whether it shipped the May 2024 Realtek patch.
- For the LevelOne WBR-6013, plan a replacement, since Talos reports no patch from the vendor.
- Limit access to the device's admin interface to a small management network.
- Change default admin passwords and disable remote management.
- Verify firmware images against vendor checksums where the vendor provides them.
Why it matters
A device that accepts any firmware file lets an attacker with admin access install code of their choosing, and that code survives reboots. A signed update process is meant to stop exactly this.
The larger lesson is about supply chain depth. An SDK flaw reaches every brand that ships the SDK, and each brand decides alone whether to patch. When a vendor declines, your options are isolation or replacement.
The weakness classes involved are CWE-347 (Improper Verification of Cryptographic Signature). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Talos and NVD agree on 7.2 High. Talos says the SDK vendor patched and the router vendor declined, so the fixed status depends on the product.
Quick check
Is there a fix for the LevelOne WBR-6013?
Talos reports that LevelOne declined to patch. Realtek released a patch to its customers on 20 May 2024.
Does the attacker need a login?
The vector requires high privileges, so an administrative login or equivalent is needed.
Sources
Last reviewed: 19 October 2026.
