Vulnerability · Published May 19, 2022 · Assigned by icscert

CVE-2021-32934ThroughTek P2P SDK - Cleartext Transmission of Sensitive Information

Critical 9.1

In plain English

A critical-severity security flaw in P2P SDK from ThroughTek. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.7%top 45.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module) do not sufficiently protect data transferred between the local device and ThroughTek servers. This can allow an attacker to access sensitive information, such as camera feeds.

Affected products (as reported)

Vendor	Product	Versions
ThroughTek	P2P SDK	all with nossl tagfirmware using AVAPI module without enabling DTLS mechanismfirmware using P2PTunnel or RDT moduleAll – through 3.1.5

Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-01 x_refsource_MISC