What is CVE-2021-32934?

CVE-2021-32934 is a critical-severity vulnerability in Throughtek Kalay P2p Software Development Kit, classified under Cleartext Transmission of Sensitive Information. CVSS score: 9.1/10. Published 2022-05-19.

How severe is CVE-2021-32934?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Vulnerability in Throughtek Kalay P2p Software Development Kit

CVE-2021-32934

The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module) do not sufficiently protect data transferred between the local device and ThroughTek servers. This can allow an attacker to access sensitive information, such as camera feeds.

EPSS: 0.006 (45.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Throughtek Kalay_p2p_software_development_kit
Throughtek P2p Sdk — versions all with nossl tag, firmware using AuthKey for IOTC connection, firmware using AVAPI module without enabling DTLS mechanism

Weakness classification (CWE)

CWE-319 — Cleartext Transmission of Sensitive Information

References

ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-32934?: CVE-2021-32934 is a critical-severity vulnerability in Throughtek Kalay P2p Software Development Kit, classified under Cleartext Transmission of Sensitive Information. CVSS score: 9.1/10. Published 2022-05-19.
How severe is CVE-2021-32934?: Critical severity. CVSS v3 base score is 9.1 out of 10.