Improper access control in ThroughTek Kalay P2P SDK

1) Improper access control

EUVDB-ID: #VU55929

Risk: High

CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28372

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can bypass implemented security restrictions to gain access to sensitive information (such as camera feeds) and execute arbitrary code on the system.

This vulnerability affects the following versions of P2P Software Development Kit (SDK):

• SDK versions with the nossl tag
• Device firmware that does not use AuthKey for IOTC connection
• Device firmware using the AVAPI module without enabling DTLS mechanism
• Device firmware using P2PTunnel or RDT module

Mitigation

Install updates from vendor's website.

Vulnerable software versions

P2P SDK: 3.1.5

External links

http://www.fireeye.com/blog/threat-research/2021/08/mandiant-discloses-critical-vulnerability-affecting-iot-devices.html
http://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0020/FEYE-2021-0020.md
http://www.throughtek.com/about-throughteks-kalay-platform-security-mechanism/
http://us-cert.cisa.gov/ics/advisories/icsa-21-229-01

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.