CVE-2021-28372

Katalog CVE

CVSS 8.3 · High EPSS 2,6%

Kerentanan Authentication Bypass by Spoofing pada throughtek kalay p2p software development kit. Skor CVSS 3.1 8.3 (High) menurut NVD.

Deskripsi (NVD)

ThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek (TUTK) device given a valid 20-byte uniquely assigned identifier (UID). This could result in an attacker hijacking a victim's connection and forcing them into supplying credentials needed to access the victim TUTK device.

Rincian

Terbit di NVD

17 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.3 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

2,6% peluang dieksploitasi; lebih tinggi dari 84,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.throughtek.com/kalay_overview.html broken link · advisory vendor
• https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0020/FEYE-2021-0020.md mitigasi · advisory pihak ketiga
• https://www.fireeye.com/blog/threat-research/2021/08/mandiant-discloses-critical-vulnerability-affecting-iot-d... exploit · mitigasi · advisory pihak ketiga