CVE-2023-6323
📋 TL;DR
CVE-2023-6323 is an authentication bypass vulnerability in ThroughTek Kalay SDK where message authenticity isn't verified, allowing attackers to impersonate legitimate servers. This affects IoT devices, cameras, and smart home products using the vulnerable SDK. Attackers could intercept or manipulate device communications.
💻 Affected Systems
- ThroughTek Kalay SDK
- IoT devices using Kalay SDK
- Smart cameras
- Smart home devices
📦 What is this software?
Cam 2 Firmware by Owletcare
Cam Firmware by Owletcare
Kalay Platform by Throughtek
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of affected IoT devices allowing data exfiltration, device takeover, or lateral movement into connected networks
Likely Case
Unauthorized access to device feeds, manipulation of device functionality, or denial of service
If Mitigated
Limited impact if devices are isolated in segmented networks with strict firewall rules
🎯 Exploit Status
Exploitation requires network access to vulnerable devices; no authentication needed to initiate attack
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ThroughTek has released updated SDK versions; check with device manufacturers for specific patched versions
Vendor Advisory: https://www.throughtek.com/kalay_platform.html
Restart Required: Yes
Instructions:
1. Contact device manufacturer for firmware updates 2. Apply manufacturer-provided patches 3. Restart affected devices 4. Verify communication integrity
🔧 Temporary Workarounds
Network Segmentation
allIsolate IoT devices in separate VLANs with strict firewall rules
Access Control Lists
allRestrict network access to Kalay devices from trusted sources only
🧯 If You Can't Patch
- Segment IoT network from critical infrastructure
- Monitor network traffic for unusual Kalay protocol patterns
🔍 How to Verify
Check if Vulnerable:
Check device firmware version against manufacturer advisories; monitor for unexpected Kalay protocol trafficCheck Version:
Manufacturer-specific commands vary; typically through device management interface or SSHVerify Fix Applied:
Verify updated firmware version; test device communication integrity📡 Detection & Monitoring
Log Indicators:
- Unexpected authentication failures
- Unusual Kalay protocol patterns
- Device communication anomalies
Network Indicators:
- Suspicious Kalay protocol traffic from untrusted sources
- Unexpected server impersonation attempts
SIEM Query:
source_ip NOT IN trusted_networks AND protocol="Kalay" AND (event_type="authentication_bypass" OR message_integrity_failure)