ThroughTek

Records6All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high4CVSS 7.0–8.9

Exploited now

ThroughTek records in CISA KEV

No ThroughTek vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Kalay Platform 4 records MEDIUM Kalay P2p Software Development Kit 2 records MEDIUM

Records

6 records

TI-2021-12543 CVE-2021-32934 · GHSA-3v34-r58h-wm2h

ThroughTek P2P SDK - Cleartext Transmission of Sensitive Information

MEDIUM 49

The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00736 Published 2022-05-19 Fixed in firmware using AuthKey for IOTC connection CWE-319

TI-2023-05804 CVE-2023-6321 · GHSA-7h6w-cw39-chrh

Owlet Camera OS command injection

MEDIUM 45

A command injection vulnerability exists in the IOCTL that manages OTA updates.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02748 Published 2024-05-15 Fixed in 4.2.10, 4.2.11 CWE-78

TI-2023-05805 CVE-2023-6322 · GHSA-cw8j-9ggg-f37g

Stack-based buffer overflow in message parser functionality

MEDIUM 42

A stack-based buffer overflow vulnerability exists in the message parsing functionality of the Roku Indoor Camera SE version 3.0.2.4679 and Wyze Cam v3 version 4.36.11.5859.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01022 Published 2024-05-15 No fix listed CWE-121

TI-2023-05807 CVE-2023-6324 · GHSA-8xpm-gr22-c94j

ThroughTek Kalay SDK error in handling the PSK identity

MEDIUM 41

ThroughTek Kalay SDK uses a predictable PSK value in the DTLS session when encountering an unexpected PSK identity

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00712 Published 2024-05-15 No fix listed CWE-457

TI-2021-09526 CVE-2021-28372 · GHSA-h5gx-r98q-mqhf

ThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary…

MEDIUM 41

ThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek (TUTK) device given a valid 20-byte uniquely assigned identifier (UID).

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.02554 Published 2021-08-17 No fix listed CWE-290

TI-2023-05806 CVE-2023-6323 · GHSA-fc4q-rhhm-x7fh

ThroughTek Kalay SDK insufficient verification of message authenticity

LOW 29

ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00328 Published 2024-05-15 Fixed in 4.3.4.2 CWE-345

Open these records in search →

Critical	1
High	4
Medium	1
Low	0
No CVSS	0