Assigner | Bitdefender |
Reserved | 2023-11-27 |
Published | 2024-05-15 |
Updated | 2024-06-04 |
Description
ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Problem types
CWE-345 Insufficient Verification of Data Authenticity
Product status
Any version before 4.3.4.2
Credits
Alexandru Lazar
Radu Basaraba
References
https://bitdefender.com/blog/labs/notes-on-throughtek-kalay-vulnerabilities-and-their-impact/