{"vulnerability": "cve-2021-32934", "sightings": [{"uuid": "ce53530a-f09c-4686-a4ec-fee38c0b40cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32934", "type": "seen", "source": "https://t.me/cibsecurity/42995", "content": "\u203c CVE-2021-32934 \u203c\n\nThe affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module) do not sufficiently protect data transferred between the local device and ThroughTek servers. This can allow an attacker to access sensitive information, such as camera feeds.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-05-19T22:29:48.000000Z"}, {"uuid": "5f7639d0-d2bb-44f5-8636-f1135b233779", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32934", "type": "seen", "source": "https://t.me/thehackernews/1292", "content": "CISA has issued an advisory warning #IoT manufacturers of a critical vulnerability \u2014 CVE-2021-32934 / CVSS score: 9.1 \u2014in ThroughTek's P2P SDK that could be exploited by attackers to eavesdrop on connected cameras.\n\nRead: https://thehackernews.com/2021/06/critical-throughtek-flaw-opens-millions.html", "creation_timestamp": "2021-06-16T09:22:07.000000Z"}, {"uuid": "1eeae59f-93d0-4e09-a901-de094bc9dffb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32934", "type": "seen", "source": "https://t.me/hacking_Attack/13342", "content": "Black Hat Ethical Hacking\nMillions of Connected Cameras Open to Eavesdropping\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Millions of Connected Cameras Open to EavesdroppingPost Views: 226 \nReading Time: 1 Minute\nMillions of connected security and home cameras contain a critical software vulnerability that can allow remote attackers to tap into video feeds, according to a warning from the Cybersecurity and Infrastructure Security Agency (CISA).\nThe bug (CVE-2021-32934, with a CVSS v3 base score of 9.1) has been introduced via a supply-chain component from ThroughTek that\u2019s used by several original equipment manufacturers (OEMs) of security cameras \u2013 along with makers of IoT devices like baby- and pet-monitoring cameras, and robotic and battery devices.\n\nThe potential issues stemming from unauthorized viewing of feeds from these devices are myriad: For critical infrastructure operators and enterprises, video-feed interceptions could reveal sensitive business data, production/competitive secrets, information on floorplans for use in physical attacks, and employee information. And for home users, the privacy implications are obvious.\n\nIn its alert, issued Tuesday, CISA said that so far, no known public exploits are targeting the bug in the wild yet.\nSee Also: RockYou2021: largest password compilation of all time leaked online \u2013 8.4 billion entries Vulnerable P2P SDKThe ThroughTek component at issue is its peer-to-peer (P2P) software development kit (SDK), which has been installed in several million connected devices, according to the supplier. It\u2019s used to provide remote access to audio and video streams over the internet.\n\nNozomi Networks, which discovered the bug, noted that the way P2P works is based on three architectural aspects:\n\n* A network video recorder (NVR), which is connected to security cameras and represents the local P2P server that generates the audio/video stream.\n* An offsite P2P server, managed by the camera vendor or P2P SDK vendor. This server acts as a middleman, allowing the client and NVR to establish a connection to each other.\n* A software client, either a mobile or a desktop application, that accesses the audio/video stream from the internet.\n\n\u201cA peculiarity of P2P SDKs\u2026is that OEMs are not just licensing a P2P software library,\u201d analysts at Nozomi Networks pointed out, in a Tuesday posting. \u201cThey also receive infrastructure services (the offsite P2P server) for authenticating clients and servers and handling the audio/video stream.\u201d\n\nIn analyzing the specific client implementation for ThroughTek\u2019s P2P platform and the network traffic generated by a Windows client connecting to the NVR through P2P, Nozomi researchers found that the data transferred between the local device and ThroughTek servers lacked a secure key exchange, relying instead on an obfuscation scheme based on a fixed key.\n\n\u201cAfter setting a few breakpoints in the right spots, we managed to identify interesting code where the network\u2019s packet payload is de-obfuscated,\u201d according to Nozomi\u2019s writeup. \u201cSince this traffic traverses the internet, an attacker that is able to access it can reconstruct the audio/video stream.\u201d\nSee Also: Offensive Security Tool: CloudFail Nozomi was able to create a proof-of-concept script that de-obfuscates on-the-fly packets from network traffic, it said, but no further technical details were given. Notably, ThroughTek\u2019s advisory\u00a0also listed device-spoofing and device-certificate hijacking as other potential risks from any exploitation of the bug. The supplier has patched the issue in the latest version of the firmware. Affected Versions and Remedies:* All versions[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:36.031119Z"}, {"uuid": "86f9885e-18ce-49e1-a13a-8b21552441cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32934", "type": "seen", "source": "https://t.me/hacking_Attack/13342", "content": "Black Hat Ethical Hacking\nMillions of Connected Cameras Open to Eavesdropping\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Millions of Connected Cameras Open to EavesdroppingPost Views: 226 \nReading Time: 1 Minute\nMillions of connected security and home cameras contain a critical software vulnerability that can allow remote attackers to tap into video feeds, according to a warning from the Cybersecurity and Infrastructure Security Agency (CISA).\nThe bug (CVE-2021-32934, with a CVSS v3 base score of 9.1) has been introduced via a supply-chain component from ThroughTek that\u2019s used by several original equipment manufacturers (OEMs) of security cameras \u2013 along with makers of IoT devices like baby- and pet-monitoring cameras, and robotic and battery devices.\n\nThe potential issues stemming from unauthorized viewing of feeds from these devices are myriad: For critical infrastructure operators and enterprises, video-feed interceptions could reveal sensitive business data, production/competitive secrets, information on floorplans for use in physical attacks, and employee information. And for home users, the privacy implications are obvious.\n\nIn its alert, issued Tuesday, CISA said that so far, no known public exploits are targeting the bug in the wild yet.\nSee Also: RockYou2021: largest password compilation of all time leaked online \u2013 8.4 billion entries Vulnerable P2P SDKThe ThroughTek component at issue is its peer-to-peer (P2P) software development kit (SDK), which has been installed in several million connected devices, according to the supplier. It\u2019s used to provide remote access to audio and video streams over the internet.\n\nNozomi Networks, which discovered the bug, noted that the way P2P works is based on three architectural aspects:\n\n* A network video recorder (NVR), which is connected to security cameras and represents the local P2P server that generates the audio/video stream.\n* An offsite P2P server, managed by the camera vendor or P2P SDK vendor. This server acts as a middleman, allowing the client and NVR to establish a connection to each other.\n* A software client, either a mobile or a desktop application, that accesses the audio/video stream from the internet.\n\n\u201cA peculiarity of P2P SDKs\u2026is that OEMs are not just licensing a P2P software library,\u201d analysts at Nozomi Networks pointed out, in a Tuesday posting. \u201cThey also receive infrastructure services (the offsite P2P server) for authenticating clients and servers and handling the audio/video stream.\u201d\n\nIn analyzing the specific client implementation for ThroughTek\u2019s P2P platform and the network traffic generated by a Windows client connecting to the NVR through P2P, Nozomi researchers found that the data transferred between the local device and ThroughTek servers lacked a secure key exchange, relying instead on an obfuscation scheme based on a fixed key.\n\n\u201cAfter setting a few breakpoints in the right spots, we managed to identify interesting code where the network\u2019s packet payload is de-obfuscated,\u201d according to Nozomi\u2019s writeup. \u201cSince this traffic traverses the internet, an attacker that is able to access it can reconstruct the audio/video stream.\u201d\nSee Also: Offensive Security Tool: CloudFail Nozomi was able to create a proof-of-concept script that de-obfuscates on-the-fly packets from network traffic, it said, but no further technical details were given. Notably, ThroughTek\u2019s advisory\u00a0also listed device-spoofing and device-certificate hijacking as other potential risks from any exploitation of the bug. The supplier has patched the issue in the latest version of the firmware. Affected Versions and Remedies:* All versions[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:12.452328Z"}]}