CVE-2021-28372

PoC —

CVSS 3.1

8.3 high

EPSS

3%p84

Published

Aug 17, 2021 (Aug 17, 2021)

Modified

Jun 17, 2026

Description

ThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek (TUTK) device given a valid 20-byte uniquely assigned identifier (UID). This could result in an attacker hijacking a victim's connection and forcing them into supplying credentials needed to access the victim TUTK device.

Vendors: throughtek
Products: kalay p2p software development kit
Weakness: CWE-290
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.6%)

In the news6 stories

Critical ThroughTek SDK Bug Could Let Attackers Spy On Millions of IoT Devices

The Hacker NewsJul 17, 17:18 UTC · Jul 17, 2023Vulnerability CVE-2021-28372 CVE-2021-32934

60

Critical bug allows remote compromise, control of millions of IoT devices (CVE-2021-28372)

Help Net SecurityJul 16, 13:38 UTC · Jul 16, 2023Vulnerability CVE-2021-28372

60

Week in review: Realtek chips vulnerabilities, NAS devices under attack, security teams burnout

Help Net SecurityAug 22, 00:00 UTC · Aug 22, 2021Vulnerability CVE-2021-28372

60

Critical Bug Could Allow Remote Snooping Via Millions of Devices

Infosecurity MagazineAug 18, 10:06 UTC · Aug 18, 2021Vulnerability CVE-2021-28372

60

Kalay cloud platform flaw exposes millions of IoT devices to hack

Security AffairsAug 17, 16:55 UTC · Aug 17, 2021Vulnerability CVE-2021-28372

60

CVE-2021-28372: How a Vulnerability in Third-Party Technology Is Leaving Many IP Cameras and Surveillance Systems Vulnerable

Palo Alto Unit 42Jun 5, 23:26 UTC · Jun 5, 2024Vulnerability CVE-2021-28372

47