Summary
ThroughTek supplies multiple original equipment manufacturers of IP cameras with P2P connections as part of its cloud platform. Successful exploitation of this vulnerability could permit unauthorized access to sensitive information, such as camera audio/video feeds.
Vulnerabilities 1
-
Critical 9.1
ThroughTek P2P SDK - Cleartext Transmission of Sensitive Information
The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module…
Revision history
-
#1
ICSA-21-166-01 ThroughTek P2P SDK
References
-
ICS Advisory ICSA-21-166-01 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-166-01
-
Recommended Practices
https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B