CVE-2021-28372
📋 TL;DR
This vulnerability in ThroughTek's Kalay Platform 2.0 allows attackers to impersonate any ThroughTek IoT device using a valid 20-byte UID. This enables credential theft and device hijacking. Affects IoT devices using ThroughTek's Kalay SDK for video streaming and remote access.
💻 Affected Systems
- ThroughTek Kalay Platform
- IoT devices using ThroughTek Kalay SDK
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of IoT devices (cameras, baby monitors, etc.) allowing unauthorized video/audio access, credential theft, and potential lateral movement to connected networks.
Likely Case
Unauthorized access to IoT device feeds, credential harvesting, and device hijacking for surveillance or botnet recruitment.
If Mitigated
Limited impact with proper network segmentation, device authentication, and monitoring in place.
🎯 Exploit Status
Exploit requires obtaining a valid 20-byte UID, which may be discoverable through network scanning or other means.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kalay Platform 3.0 or later with AuthKey and DTLS enabled
Vendor Advisory: https://www.throughtek.com/kalay_overview.html
Restart Required: Yes
Instructions:
1. Update to Kalay SDK 3.0 or later. 2. Enable AuthKey and DTLS features. 3. Update all affected IoT device firmware. 4. Restart devices after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate IoT devices on separate VLANs with strict firewall rules.
Disable Remote Access
allDisable Kalay remote access features if not required.
🧯 If You Can't Patch
- Segment IoT network and restrict inbound/outbound connections
- Monitor for unusual authentication attempts and device impersonation
🔍 How to Verify
Check if Vulnerable:
Check device firmware version and Kalay SDK version. If using Kalay Platform 2.0 or earlier without AuthKey/DTLS, device is vulnerable.Check Version:
Device-specific - consult manufacturer documentation for firmware/Kalay version check.Verify Fix Applied:
Verify Kalay SDK version 3.0+ with AuthKey and DTLS enabled in device configuration.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts
- Unusual device UID usage patterns
- Authentication from unexpected IP addresses
Network Indicators:
- Unencrypted Kalay protocol traffic
- Suspicious connections to Kalay servers
- Traffic patterns indicating device impersonation
SIEM Query:
source_ip IN (suspicious_ips) AND dest_port IN (kalay_ports) AND protocol="kalay"🔗 References
- https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0020/FEYE-2021-0020.md
- https://www.fireeye.com/blog/threat-research/2021/08/mandiant-discloses-critical-vulnerability-affecting-iot-devices.html
- https://www.throughtek.com/kalay_overview.html
- https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0020/FEYE-2021-0020.md
- https://www.fireeye.com/blog/threat-research/2021/08/mandiant-discloses-critical-vulnerability-affecting-iot-devices.html
- https://www.throughtek.com/kalay_overview.html
