« Volver al listado

CVE-2023-6323

Estado: AnalizadaMedia (6.5)—

ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Owletcare — CAM 2 FirmwareOwletcare — CAM FirmwareRoku — Indoor Camera SE FirmwareThroughtek — Kalay PlatformWyze — CAM V3 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-6323",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-6323",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-15T14:21:02.557530Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve-requests@bitdefender.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve-requests@bitdefender.com",
      "affectedData": [
        {
          "vendor": "ThroughTek",
          "product": "Kalay SDK",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.3.4.2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:throughtek:kalay_sdk:*:*:*:*:*:*:*:*"
          ],
          "vendor": "throughtek",
          "product": "kalay_sdk",
          "versions": [
            {
              "status": "affected",
              "version": "*"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-15T13:15:25.780",
  "references": [
    {
      "url": "https://bitdefender.com/blog/labs/notes-on-throughtek-kalay-vulnerabilities-and-their-impact/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve-requests@bitdefender.com"
    },
    {
      "url": "https://bitdefender.com/blog/labs/notes-on-throughtek-kalay-vulnerabilities-and-their-impact/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve-requests@bitdefender.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server."
    },
    {
      "lang": "es",
      "value": "ThroughTek Kalay SDK no verifica la autenticidad de los mensajes recibidos, lo que permite a un atacante hacerse pasar por un servidor autorizado."
    }
  ],
  "lastModified": "2026-06-17T06:50:32.390",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:wyze:cam_v3_firmware:4.36.11.5859:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4FE4DD58-8A90-43ED-B613-AB7D0BBA63A4"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:wyze:cam_v3:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "C96BD4E4-F38A-4D78-851D-0F879B4D3A16"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:roku:indoor_camera_se_firmware:3.0.2.4679:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B79DA37F-D435-470A-812C-5DB730F91A85"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:roku:indoor_camera_se:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "EF28236D-4618-4E8A-A8A5-60DD6104D9CD"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:owletcare:cam_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C11F124-BEE1-4FAF-9BD6-CA0BC81AF56C",
              "versionEndExcluding": "4.2.11"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:owletcare:cam:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F8A54D2C-9F78-4B06-B5CD-3DBE54F031BF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:owletcare:cam_2_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "167A51A1-6B23-45B2-9038-A8A65966EB83",
              "versionEndExcluding": "4.2.10"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:owletcare:cam_2:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D9E25B26-657F-4953-B06E-E70F9D397888"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:throughtek:kalay_platform:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4176E066-18DF-47D7-8604-2596C2F37EB6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve-requests@bitdefender.com"
}