CVE-2021-32934

—

CVSS 3.1

7.5 high

EPSS

<1%p48

Published

May 19, 2022 (May 19, 2022)

Modified

Jun 17, 2026

Description

The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module) do not sufficiently protect data transferred between the local device and ThroughTek servers. This can allow an attacker to access sensitive information, such as camera feeds.

Vendors: throughtek
Products: kalay p2p software development kit
Weakness: CWE-319
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news2 stories

Critical ThroughTek SDK Bug Could Let Attackers Spy On Millions of IoT Devices

The Hacker NewsJul 17, 17:18 UTC · Jul 17, 2023Vulnerability CVE-2021-28372 CVE-2021-32934

Critical ThroughTek Flaw Opens Millions of Connected Cameras to Eavesdropping

The Hacker NewsJun 17, 03:28 UTC · Jun 17, 2021Exploit / PoC CVE-2021-32934