Search criteria
3 vulnerabilities by ThroughTek
CVE-2023-6324 (GCVE-0-2023-6324)
Vulnerability from cvelistv5 – Published: 2024-05-15 12:09 – Updated: 2024-08-02 08:28
VLAI?
Title
ThroughTek Kalay SDK error in handling the PSK identity
Summary
ThroughTek Kalay SDK uses a predictable PSK value in the DTLS session when encountering an unexpected PSK identity
Severity ?
8.1 (High)
CWE
- CWE-457 - Use of Uninitialized Variable
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ThroughTek | Kalay SDK |
Affected:
3.1.10.0 , ≤ 3.1.10.16
(custom)
Affected: 3.2.0.0 , ≤ 3.3.6.1 (custom) Affected: 3.4.0.0 , ≤ 3.4.7.3 (custom) Affected: 4.0.0.0 , ≤ 4.3.3.1 (custom) |
Credits
Alexandru Lazar
Radu Basaraba
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:throughtek:kalay_sdk:3.1.10.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "kalay_sdk",
"vendor": "throughtek",
"versions": [
{
"status": "affected",
"version": "3.1.10.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:throughtek:kalay_sdk:3.2.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "kalay_sdk",
"vendor": "throughtek",
"versions": [
{
"status": "affected",
"version": "3.2.0.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:throughtek:kalay_sdk:3.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "kalay_sdk",
"vendor": "throughtek",
"versions": [
{
"status": "affected",
"version": "3.4.0.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:throughtek:kalay_sdk:4.0.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "kalay_sdk",
"vendor": "throughtek",
"versions": [
{
"status": "affected",
"version": "4.0.0.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-6324",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-15T16:02:56.677237Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:17:18.138Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:28:21.511Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://bitdefender.com/blog/labs/notes-on-throughtek-kalay-vulnerabilities-and-their-impact/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Kalay SDK",
"vendor": "ThroughTek",
"versions": [
{
"lessThanOrEqual": "3.1.10.16",
"status": "affected",
"version": "3.1.10.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.3.6.1",
"status": "affected",
"version": "3.2.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.4.7.3",
"status": "affected",
"version": "3.4.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.3.3.1",
"status": "affected",
"version": "4.0.0.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alexandru Lazar"
},
{
"lang": "en",
"type": "finder",
"value": "Radu Basaraba"
}
],
"datePublic": "2024-05-15T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eThroughTek Kalay SDK uses a predictable PSK value in the DTLS session when encountering an unexpected PSK identity \u003c/p\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "ThroughTek Kalay SDK uses a predictable PSK value in the DTLS session when encountering an unexpected PSK identity"
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-457",
"description": "CWE-457 Use of Uninitialized Variable",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-15T12:09:29.682Z",
"orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"shortName": "Bitdefender"
},
"references": [
{
"url": "https://bitdefender.com/blog/labs/notes-on-throughtek-kalay-vulnerabilities-and-their-impact/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ThroughTek Kalay SDK error in handling the PSK identity",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"assignerShortName": "Bitdefender",
"cveId": "CVE-2023-6324",
"datePublished": "2024-05-15T12:09:29.682Z",
"dateReserved": "2023-11-27T14:22:36.362Z",
"dateUpdated": "2024-08-02T08:28:21.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-6323 (GCVE-0-2023-6323)
Vulnerability from cvelistv5 – Published: 2024-05-15 12:08 – Updated: 2024-08-02 08:28
VLAI?
Title
ThroughTek Kalay SDK insufficient verification of message authenticity
Summary
ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server.
Severity ?
4.3 (Medium)
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ThroughTek | Kalay SDK |
Affected:
0 , < 4.3.4.2
(custom)
|
Credits
Alexandru Lazar
Radu Basaraba
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:throughtek:kalay_sdk:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "kalay_sdk",
"vendor": "throughtek",
"versions": [
{
"status": "affected",
"version": "*"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-6323",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-15T14:21:02.557530Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:17:09.423Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:28:21.783Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://bitdefender.com/blog/labs/notes-on-throughtek-kalay-vulnerabilities-and-their-impact/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Kalay SDK",
"vendor": "ThroughTek",
"versions": [
{
"lessThan": "4.3.4.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alexandru Lazar"
},
{
"lang": "en",
"type": "finder",
"value": "Radu Basaraba"
}
],
"datePublic": "2024-05-15T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server. \u003c/p\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server."
}
],
"impacts": [
{
"capecId": "CAPEC-151",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-151 Identity Spoofing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-15T12:08:57.397Z",
"orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"shortName": "Bitdefender"
},
"references": [
{
"url": "https://bitdefender.com/blog/labs/notes-on-throughtek-kalay-vulnerabilities-and-their-impact/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ThroughTek Kalay SDK insufficient verification of message authenticity",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"assignerShortName": "Bitdefender",
"cveId": "CVE-2023-6323",
"datePublished": "2024-05-15T12:08:57.397Z",
"dateReserved": "2023-11-27T14:22:35.440Z",
"dateUpdated": "2024-08-02T08:28:21.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-32934 (GCVE-0-2021-32934)
Vulnerability from cvelistv5 – Published: 2022-05-19 17:20 – Updated: 2025-04-16 16:19
VLAI?
Title
ThroughTek P2P SDK - Cleartext Transmission of Sensitive Information
Summary
The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module) do not sufficiently protect data transferred between the local device and ThroughTek servers. This can allow an attacker to access sensitive information, such as camera feeds.
Severity ?
9.1 (Critical)
CWE
- CWE-319 - Cleartext Transmission of Sensitive Information
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ThroughTek | P2P SDK |
Affected:
all with nossl tag
Unaffected: firmware using AuthKey for IOTC connection Affected: firmware using AVAPI module without enabling DTLS mechanism Affected: firmware using P2PTunnel or RDT module Affected: All , ≤ 3.1.5 (custom) |
Credits
Nozomi Networks reported this vulnerability to CISA.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:56.086Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-01"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-32934",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:54:43.160260Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:19:34.297Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "P2P SDK",
"vendor": "ThroughTek",
"versions": [
{
"status": "affected",
"version": "all with nossl tag"
},
{
"status": "unaffected",
"version": "firmware using AuthKey for IOTC connection"
},
{
"status": "affected",
"version": "firmware using AVAPI module without enabling DTLS mechanism"
},
{
"status": "affected",
"version": "firmware using P2PTunnel or RDT module"
},
{
"lessThanOrEqual": "3.1.5",
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Nozomi Networks reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"value": "The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module) do not sufficiently protect data transferred between the local device and ThroughTek servers. This can allow an attacker to access sensitive information, such as camera feeds."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "CWE-319 Cleartext Transmission of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-19T17:20:06.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-01"
}
],
"source": {
"advisory": "ICSA-21-166-01",
"discovery": "UNKNOWN"
},
"title": "ThroughTek P2P SDK - Cleartext Transmission of Sensitive Information",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2021-32934",
"STATE": "PUBLIC",
"TITLE": "ThroughTek P2P SDK - Cleartext Transmission of Sensitive Information"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "P2P SDK",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "All",
"version_value": "3.1.5"
},
{
"version_affected": "=",
"version_value": "all with nossl tag"
},
{
"version_affected": "!",
"version_value": "firmware using AuthKey for IOTC connection"
},
{
"version_affected": "=",
"version_value": "firmware using AVAPI module without enabling DTLS mechanism"
},
{
"version_affected": "=",
"version_value": "firmware using P2PTunnel or RDT module"
}
]
}
}
]
},
"vendor_name": "ThroughTek"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Nozomi Networks reported this vulnerability to CISA."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module) do not sufficiently protect data transferred between the local device and ThroughTek servers. This can allow an attacker to access sensitive information, such as camera feeds."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-319 Cleartext Transmission of Sensitive Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-01",
"refsource": "MISC",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-01"
}
]
},
"source": {
"advisory": "ICSA-21-166-01",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2021-32934",
"datePublished": "2022-05-19T17:20:06.000Z",
"dateReserved": "2021-05-13T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:19:34.297Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}