by Kastro
Paper/Archive/CVE-2021-32934

CVE-2021-32934

ThroughTek P2P SDK — ThroughTek P2P SDK - Cleartext Transmission of Sensitive Information

EPSS 0.7%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 54.5.545 × 2010.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module) do not sufficiently protect data transferred between the local device and ThroughTek servers. This can allow an attacker to access sensitive information, such as camera feeds.

Affected

ProductAffectedFixed inSource
P2P SDKall with nossl tag–CNA
P2P SDKfirmware using AVAPI module without enabling DTLS mechanism–CNA
P2P SDKfirmware using P2PTunnel or RDT module–CNA
P2P SDKAll – 3.1.5–CNA

Scores by source

icscert (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-21-166-01