Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2023-6323: ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server.
CVE-2023-6323 · published 2 years ago
Summary
ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server.
What to do
- Update owletcare cam_firmware to version 4.2.11 or later.
- Update owletcare cam_2_firmware to version 4.2.10 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wyze | cam_v3_firmware |
4.36.11.5859 cpe:2.3:o:wyze:cam_v3_firmware:4.36.11.5859:*:*:*:*:*:*:* |
| roku | indoor_camera_se_firmware |
3.0.2.4679 cpe:2.3:o:roku:indoor_camera_se_firmware:3.0.2.4679:*:*:*:*:*:*:* |
| owletcare | cam_firmware |
< 4.2.11 cpe:2.3:o:owletcare:cam_firmware:*:*:*:*:*:*:*:* |
| owletcare | cam_2_firmware |
< 4.2.10 cpe:2.3:o:owletcare:cam_2_firmware:*:*:*:*:*:*:*:* |
| throughtek | kalay_platform |
All versions
cpe:2.3:a:throughtek:kalay_platform:-:*:*:*:*:*:*:* |
Original advisory text
ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server.
ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server.
References
- https://bitdefender.com/blog/labs/notes-on-throughtek-kalay-vulnerabilities-and-... Exploit Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-345Insufficient Verification of Data Authenticity
Timeline
Published15 May 2024
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2023-6323 · NVD
Track software like this
Free during beta