CVE-2021-28372: How a Vulnerability in Third-Party Technology Is Leaving Many IP Cameras and Surveillance Systems Vulnerable
Summary: Researchers identified CVE-2021-28372, a vulnerability in the ThroughTek Kalay P2P SDK built into IP cameras, video recorders and baby monitors, which lets an attacker impersonate a device using a 20-bit unique identifier, hijack a victim's connection and extract credentials; it carries a CVSS score of 9.6. ThroughTek Kalay states its SDK is in use on 86 million online devices making over 1.1 billion monthly connections, and devices send call-home messages to more than 14 different IP addresses on random UDP ports between 10000 and 20000 to establish P2P connections.
Bottom line: The vulnerable code sits in an embedded third-party SDK, so a device with no known vendor vulnerabilities can still be exposed - and the 86 million devices running it connect to international servers their buyers never knew about.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-28372
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026