Vendors / Roku Records 5 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 2
Exploited now Roku records in CISA KEV No Roku vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 45
The External Control API in Roku and Roku TV products allow unauthorized access via a DNS Rebind attack.
CVSS 3.0 CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.01928 · Published 2018-07-03 · No fix listed CWE-20
Priority MEDIUM 42
A stack-based buffer overflow vulnerability exists in the message parsing functionality of the Roku Indoor Camera SE version 3.0.2.4679 and Wyze Cam v3 version 4.36.11.5859.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01022 · Published 2024-05-15 · No fix listed CWE-121
Priority MEDIUM 41
ThroughTek Kalay SDK uses a predictable PSK value in the DTLS session when encountering an unexpected PSK identity
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00712 · Published 2024-05-15 · No fix listed CWE-457
Priority LOW 29
ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server.
CVSS 3.1 MEDIUM 6.5· Adjacent network · No auth · No interaction · EPSS 0.00328 · Published 2024-05-15 · Fixed in 4.3.4.2 CWE-345
Priority LOW 25
Roku devices running RokuOS v9.4.0 build 4200 or earlier that uses a Realtek WiFi chip is vulnerable to Arbitrary file modification.
CVSS 3.1 MEDIUM 5.7· Adjacent network · Low privileges · No interaction · EPSS 0.0031 · Published 2022-04-08 · No fix listed
Open these records in search → All records by CVSS severity
1 2 2 0 0
THREATIST.IORead the docs