Millions of IoT Devices Vulnerable to Attacks, Posing Risk of Full Takeover

Researchers have uncovered four significant vulnerabilities in the ThroughTek Kalay Platform, utilized by 100 million IoT-enabled devices. ThroughTek Kalay’s widespread influence underscores the need to safeguard homes, businesses, and integrators. Affected cameras include the Roku Indoor Camera SE, Wyze Cam v3, and Owlet Cam v1 and v2.

When combined, the identified vulnerabilities, tracked as CVE-2023-6321, CVE-2023-6322, CVE-2023-6323, and CVE-2023-6324, enable both remote code execution to fully compromise the victim device and unauthorized root access from within the local network.

BitDefender researchers conveyed to Cyber Security News that “When linked in succession, these vulnerabilities enable unauthorized root access from within the local network, along with remote code execution, ultimately enabling full subversion of the victim device.”

Overview of Significant Vulnerabilities:

CVE-2023-6321: Owlet Camera OS Command Injection This vulnerability allows for the complete compromise of the device, as it permits an authorized user to execute system commands as the root user. The advisory notes, “An attacker can exploit authenticated requests to trigger this vulnerability.”

CVE-2023-6322: Stack-Based Buffer Overflow By exploiting a stack-based buffer overflow vulnerability in the handler of an IOCTL message—commonly used for configuring motion detection zones in cameras—attackers can gain root access. This vulnerability is specific to certain devices with motion detection capabilities.

CVE-2023-6323: ThroughTek Kalay SDK Insufficient Verification This vulnerability offers a route for a local attacker to acquire the AuthKey secret without authorization, thereby enabling an attacker’s initial connection to the victim’s device.

CVE-2023-6324: ThroughTek Kalay SDK Error in PSK Identity Handling This vulnerability exploits a flaw that allows attackers to deduce the pre-shared key for a DTLS session, a necessary step to establish a connection and communicate with the target devices.

Impacted Manufacturers:

The affected cameras include the Roku Indoor Camera SE, Wyze Cam v3, and Owlet Cam v1 and v2.

Recommendation:

Bitdefender reported these vulnerabilities to ThroughTek on October 19, 2023, and the manufacturer has since released patches to address them. Users of the affected devices are strongly advised to ensure they have applied all available updates.