CVE-2023-6323 ThroughTek Kalay SDK insufficient verification of message authenticity
Attackers can impersonate authoritative servers due to missing message authenticity checks in the ThroughTek Kalay SDK.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-6323?
CVE-2023-6323 is a medium-severity vulnerability in ThroughTek Kalay SDK, published on 15 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server.
Weakness: CWE-345
Which versions are affected by CVE-2023-6323?
It affects 5 products.
Products include Owletcare Cam 2 Firmware, Owletcare Cam Firmware, Roku Indoor Camera Se Firmware, Throughtek Kalay Platform, Wyze Cam V3 Firmware.
How do I fix CVE-2023-6323?
No fix has been published for CVE-2023-6323 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-6323 being exploited?
There is no known exploitation of CVE-2023-6323 in the wild and no public exploit code.
Other vulnerabilities in ThroughTek Kalay SDK
Sources
Also known as GHSA-fc4q-rhhm-x7fh.