{"vulnerability": "cve-2021-28372", "sightings": [{"uuid": "3eddc1a7-0092-4873-a9ea-f412bd95dd15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28372", "type": "seen", "source": "https://t.me/true_secator/2016", "content": "\u041d\u0435 \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u044e\u0442 \u0443\u0434\u0438\u0432\u043b\u044f\u0442\u044c \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u044b \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 IoT-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0427\u0442\u043e \u043d\u0435 \u0431\u0430\u0433\u0430, \u0442\u043e \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u043e\u0439 \u0434\u0435\u0441\u044f\u0442\u043a\u0438 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0434\u0435\u0432\u0430\u0439\u0441\u043e\u0432. \n\n\u041d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u00a0\u0432\u0435\u0431-\u043a\u0430\u043c\u0435\u0440 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0440\u0430\u0434\u0438\u043e\u043d\u044f\u043d\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u043e\u0442\u043e\u043a\u043e\u0432\u043e\u043c\u0443 \u0432\u0438\u0434\u0435\u043e \u0438 \u0430\u0443\u0434\u0438\u043e, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0443\u0433\u0440\u043e\u0437\u0443 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u0439 \u0441\u0435\u0442\u0435\u0439 \u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0414\u0430\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0441\u0435\u0442\u044c ThroughTek Kalay. \u0421\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u0433\u0440\u043e\u0437\u0430\u0445 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b\u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Mandiant \u0432 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u0447\u0435\u0441\u0442\u0432\u0435 \u0441 \u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e\u043c \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b (CISA) \u0438 ThroughTek.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0441\u043f\u0435\u0446\u043e\u0432, \u043a\u0440\u043e\u043c\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432\u0438\u0434\u0435\u043e \u0438 \u0430\u0443\u0434\u0438\u043e, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u043c\u0435\u044e\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0431\u043e\u0442-\u0441\u0435\u0442\u0438 \u0438\u0437 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0434\u043b\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0445 \u0430\u0442\u0430\u043a. \u0423\u0433\u0440\u043e\u0437\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043e 83 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0445 \u043a \u0441\u0435\u0442\u0438 Kalay.\n\n\u041a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f IoT-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0434\u043e\u0441\u0442\u0438\u0433\u0430\u0435\u0442\u0441\u044f \u043f\u0443\u0442\u0435\u043c \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 UID \u0441 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 Kalay, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0435\u043d \u0447\u0435\u0440\u0435\u0437 \u0440\u0435\u0432\u0435\u0440\u0441 \u0432\u0435\u0431-API \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445\u00a0 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0430 Google Play \u0438 Apple Store. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e UID \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d \u0430\u0442\u0430\u043a\u0435 Brute Force. \u041f\u043e\u043b\u0443\u0447\u0438\u0432 UID, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0435\u0433\u043e \u0441\u0435\u0442\u0438 Kalay, \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0432 \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443.\n\n\u0414\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0430\u0440\u043a\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2021-28372 \u0438 \u0438\u043c\u0435\u0435\u0442 \u043e\u0446\u0435\u043d\u043a\u0443 9,6 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0435\u0435 \u043a\u0430\u043a \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e. \u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0438 \u0441\u0435\u0442\u0435\u0439 \u043e\u0442 \u0430\u0442\u0430\u043a \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 Kalay 3.1.10.", "creation_timestamp": "2021-08-18T16:01:39.000000Z"}, {"uuid": "b99a7388-719f-43c0-80e7-22f5b4bc9351", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28372", "type": "seen", "source": "https://t.me/cibsecurity/27466", "content": "\u203c CVE-2021-28372 \u203c\n\nThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek (TUTK) device given a valid 20-byte uniquely assigned identifier (UID). This could result in an attacker hijacking a victim's connection and forcing them into supplying credentials needed to access the victim TUTK device.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-18T02:16:07.000000Z"}, {"uuid": "1d3d138c-2440-4771-8a7b-71a99c777a24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28372", "type": "seen", "source": "https://t.me/thehackernews/1452", "content": "FireEye has disclosed a new critical vulnerability (CVE-2021-28372) in the ThroughTek Kalay P2P SDK that could allow remote attackers to take control of affected devices, spy on camera audio and video feeds, and compromise device credentials.\n\nhttps://thehackernews.com/2021/08/critical-throughtek-sdk-bug-could-let.html", "creation_timestamp": "2021-08-18T17:52:52.000000Z"}, {"uuid": "d79361ac-a39d-465d-aad8-0660fc358b96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28372", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/4093", "content": "#Threat_Research\n1. ThroughTek \"Kalay\" Protocol Vulnerability (CVE-2021-28372)\nhttps://www.fireeye.com/blog/threat-research/2021/08/mandiant-discloses-critical-vulnerability-affecting-iot-devices.html\n2. Fortinet FortiWeb Vulnerability (CVE-2021-22123)\nhttps://www.rapid7.com/blog/post/2021/08/17/fortinet-fortiweb-os-command-injection", "creation_timestamp": "2021-08-18T12:43:39.000000Z"}, {"uuid": "4d1c7ebe-f4ce-4454-bf9b-d9e1ad8b3425", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28372", "type": "seen", "source": "https://t.me/cissp/4040", "content": "exploit\nInteger Overflow to RCE - ManageEngine Asset Explorer Agent (CVE-2021-20082)\ud83d\ude2c\nhttps://medium.com/tenable-techblog/integer-overflow-to-rce-manageengine-asset-explorer-agent-cve-2021-20082-7e54cb2caad5\n\nThreat Research\n1. ThroughTek \"Kalay\" Protocol Vulnerability (CVE-2021-28372)\nhttps://www.fireeye.com/blog/threat-research/2021/08/mandiant-discloses-critical-vulnerability-affecting-iot-devices.html\n\nOffensive security\nExecuting Code In Context Of A Trusted Agent (Part 1) - Windows Defender Antivirus\nhttps://halove23.blogspot.com/2021/08/executing-code-in-context-of-trusted.html?m=1\n]-> PoC:\nhttps://github.com/klinix5/WinDefendInjectPoC", "creation_timestamp": "2026-09-01T17:00:42.314194Z"}, {"uuid": "844d48be-d7e8-4336-b73c-48dd5fccff91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28372", "type": "seen", "source": "https://t.me/hacking_Attack/20612", "content": "Black Hat Ethical Hacking\nBug in Millions of Flawed IoT Devices Lets Attackers Eavesdrop\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Bug in Millions of Flawed IoT Devices Lets Attackers EavesdropPost Views: 84 \nReading Time: 3 Minutes\nA remote attacker could exploit a critical vulnerability to eavesdrop on live audio & video or take control. The bug is in ThroughTek\u2019s Kalay network, used in 83m devices.\nSecurity researchers have discovered a critical flaw that affects tens of millions of internet-of-things (IoT) devices \u2013 one that exposes live video and audio streams to eavesdropping threat actors and which could enable attackers to take over control of devices, including security webcams and connected baby monitors.\n\nThe flaw, tracked as CVE-2021-28372\u00a0and FEYE-2021-0020\u00a0and assigned a critical CVSS3.1 base score of 9.6, was found in devices connected via ThroughTek\u2019s Kalay IoT cloud platform.\n\nThe alarm was sounded on Tuesday by Mandiant, in coordination with the Cybersecurity and Infrastructure Security Agency (CISA) and ThroughTek. Mandiant\u2019s Red Team discovered the vulnerability in late 2020.\n\n\u201cCVE-2021-28372 poses a huge risk to an end user\u2019s security and privacy and should be mitigated appropriately,\u201d according to Mandiant\u2019s post. \u201cUnprotected devices, such as IoT cameras, can be compromised remotely with access to a UID and further attacks are possible depending on the functionality exposed by a device.\u201d\n\nThe world has already been inundated with tales of what can happen when these kind of devices are misconfigured or riddled with vulnerabilities, and this just adds to the growing pile of scary headlines. For example, in February, a vulnerability affecting multiple baby monitors was found to expose hundreds of thousands of live devices, potentially allowing someone to drop in and view a camera\u2019s video stream.\n\nAs Mandiant explained, the flaw would enable adversaries \u201cto remotely compromise victim IoT devices, resulting in the ability to listen to live audio, watch real time video data, and compromise device credentials for further attacks based on exposed device functionality. These further attacks could include actions that would allow an adversary to remotely control affected devices.\u201d\n\nIn a Tuesday post, researchers Jake Valletta, Erik Barzdukas and Dillon Franke \u2013 who discovered the bug \u2013 explained that it\u2019s impossible to compile a comprehensive list of companies and products affected, given how the Kalay protocol is integrated by manufacturers and resellers before devices reach consumers. Though they couldn\u2019t come up with a definitive list of affected companies and products that implement the Kalay platform, they strongly advised users of IoT devices \u201cto keep device software and applications up to date and use complex, unique passwords for any accounts associated with these devices.\u201d\nSee Also: Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets Mandiant also recommends that device owners avoid connecting to affected devices from untrusted networks, such as public Wi-Fi: a recommendation that\u2019s already part of wireless best practices, as the National Security Agency (NSA) recently advised\u00a0in a public service announcement (PDF). Kalay: A Newly Unappealing HandshakeAccording to ThroughTek, \u201cKalay\u201d is an indigenous Dawu\u00a0word that means \u201chandshake,\u201d \u201csymbolizing the universal link in an interconnected world.\u201d\n\nThroughTek implements that handshake \u2013 the Kalay protocol \u2013 as a software development kit (SDK). The Kalay SDK provides a plug-and-play network to easily connect smart devices with corresponding mobile apps.\n\nThe researchers provided an illustration that g[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:28.171888Z"}, {"uuid": "9a18aa5e-daff-4afa-9b4d-42a7ae7b16ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28372", "type": "seen", "source": "https://t.me/hacking_Attack/20614", "content": "ntent/uploads/sites/103/2021/08/17113113/capturing-credentials-e1629214353657.png Attacker exploiting device personation vulnerability to capture credentials. Source: Mandiant.\nAfter that, a threat actor can remotely connect to the victimized device, access audio/visual data and execute remote procedure calls (RPC), Mandiant said. Due to vulnerabilities in the device-implemented RPC interface, this can then lead to \u201cfully remote and complete device compromise,\u201d researchers described. Their enumeration of what makes this possible: \u201cMandiant observed that the binaries on IoT devices processing Kalay data typically ran as the privileged user root and lacked common binary protections such as Address Space Layout Randomization (\u201cASLR\u201d), Platform Independent Execution (\u201cPIE\u201d), stack canaries, and NX bits.\u201d\n\nThe figure below shows a hypothetical attack using the captured Kalay credentials to stage yet another attack by abusing the vulnerabilities in the Kalay RPC interface: https://media.threatpost.com/wp-content/uploads/sites/103/2021/08/17114402/Screen-Shot-2021-08-17-at-11.43.08-AM-e1629215096109.png See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerMandiant isn\u2019t releasing public exploit code, but it did provide the video below, which demonstrates a proof of concept for CVE-2021-28372. How to Address the BugMandiant \u201cstrongly recommends\u201d that companies using the Kalay platform follow the following guidance from ThroughTek and Mandiant:\n\n* If the implemented SDK is below version 3.1.10, upgrade the library to version 3.3.1.0 or version 3.4.2.0 and enable the Authkey and Datagram Transport Layer Security (DTLS) features provided by the Kalay platform.\n* If the implemented SDK is version 3.1.10 and above, enable Authkey and DTLS.\n* Review security controls in place on APIs or other services that return Kalay unique identifiers (UIDs).\n* Hardening features such as ASLR, PIE, NX, and stack canaries should be enabled on all binaries processing Kalay data and RPC functions should be treated as untrusted and sanitized appropriately.\n* IoT device manufactures should apply stringent controls around web APIs used to obtain Kalay UIDs, usernames, and passwords to minimize an attacker\u2019s ability to harvest sensitive materials needed to access devices remotely. Failure to protect web APIs which return valid Kalay UIDs could allow an attacker to compromise a large number of devices.\n\nMandiant thanked ThroughTek and CISA for their cooperation and support with releasing the advisory and for their \u201ccommitment to securing IoT devices globally.\u201d\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Steam-logo-90x90.jpg Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/tmobile-header-90x90.webp Hacker claims to steal data of 100 million T-mobile customers2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/depositphotos_40325161-stock-photo-microsoft-building-90x90.jpg Microsoft Warns: Another Unpatched PrintNightmare Zero-Day5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/crypto-hack-90x90.jpg Crypto Hack Earned Crooks $600 Million6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/msft-microsoft-logo-2-3-90x90.webp Actively Exploited Windows Zero-Day Gets a Patch1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/botnet-90x90.jpg Auth Bypass Bug Exploited, Affecting Millions of Routers1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/cisco-patch-90x90.png Critical Cisco Bug in VPN Routers Allows Remote Takeover1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/delete-telegram-message-e1628177080[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:28.218208Z"}, {"uuid": "b7f1f3a6-167c-48c1-be88-f12e20fde2f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28372", "type": "seen", "source": "https://t.me/hacking_Attack/20612", "content": "Black Hat Ethical Hacking\nBug in Millions of Flawed IoT Devices Lets Attackers Eavesdrop\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Bug in Millions of Flawed IoT Devices Lets Attackers EavesdropPost Views: 84 \nReading Time: 3 Minutes\nA remote attacker could exploit a critical vulnerability to eavesdrop on live audio & video or take control. The bug is in ThroughTek\u2019s Kalay network, used in 83m devices.\nSecurity researchers have discovered a critical flaw that affects tens of millions of internet-of-things (IoT) devices \u2013 one that exposes live video and audio streams to eavesdropping threat actors and which could enable attackers to take over control of devices, including security webcams and connected baby monitors.\n\nThe flaw, tracked as CVE-2021-28372\u00a0and FEYE-2021-0020\u00a0and assigned a critical CVSS3.1 base score of 9.6, was found in devices connected via ThroughTek\u2019s Kalay IoT cloud platform.\n\nThe alarm was sounded on Tuesday by Mandiant, in coordination with the Cybersecurity and Infrastructure Security Agency (CISA) and ThroughTek. Mandiant\u2019s Red Team discovered the vulnerability in late 2020.\n\n\u201cCVE-2021-28372 poses a huge risk to an end user\u2019s security and privacy and should be mitigated appropriately,\u201d according to Mandiant\u2019s post. \u201cUnprotected devices, such as IoT cameras, can be compromised remotely with access to a UID and further attacks are possible depending on the functionality exposed by a device.\u201d\n\nThe world has already been inundated with tales of what can happen when these kind of devices are misconfigured or riddled with vulnerabilities, and this just adds to the growing pile of scary headlines. For example, in February, a vulnerability affecting multiple baby monitors was found to expose hundreds of thousands of live devices, potentially allowing someone to drop in and view a camera\u2019s video stream.\n\nAs Mandiant explained, the flaw would enable adversaries \u201cto remotely compromise victim IoT devices, resulting in the ability to listen to live audio, watch real time video data, and compromise device credentials for further attacks based on exposed device functionality. These further attacks could include actions that would allow an adversary to remotely control affected devices.\u201d\n\nIn a Tuesday post, researchers Jake Valletta, Erik Barzdukas and Dillon Franke \u2013 who discovered the bug \u2013 explained that it\u2019s impossible to compile a comprehensive list of companies and products affected, given how the Kalay protocol is integrated by manufacturers and resellers before devices reach consumers. Though they couldn\u2019t come up with a definitive list of affected companies and products that implement the Kalay platform, they strongly advised users of IoT devices \u201cto keep device software and applications up to date and use complex, unique passwords for any accounts associated with these devices.\u201d\nSee Also: Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets Mandiant also recommends that device owners avoid connecting to affected devices from untrusted networks, such as public Wi-Fi: a recommendation that\u2019s already part of wireless best practices, as the National Security Agency (NSA) recently advised\u00a0in a public service announcement (PDF). Kalay: A Newly Unappealing HandshakeAccording to ThroughTek, \u201cKalay\u201d is an indigenous Dawu\u00a0word that means \u201chandshake,\u201d \u201csymbolizing the universal link in an interconnected world.\u201d\n\nThroughTek implements that handshake \u2013 the Kalay protocol \u2013 as a software development kit (SDK). The Kalay SDK provides a plug-and-play network to easily connect smart devices with corresponding mobile apps.\n\nThe researchers provided an illustration that g[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:01.514793Z"}, {"uuid": "0a4cb5ac-c6c0-4506-ad9d-6e908649ce79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28372", "type": "seen", "source": "https://t.me/hacking_Attack/20614", "content": "ntent/uploads/sites/103/2021/08/17113113/capturing-credentials-e1629214353657.png Attacker exploiting device personation vulnerability to capture credentials. Source: Mandiant.\nAfter that, a threat actor can remotely connect to the victimized device, access audio/visual data and execute remote procedure calls (RPC), Mandiant said. Due to vulnerabilities in the device-implemented RPC interface, this can then lead to \u201cfully remote and complete device compromise,\u201d researchers described. Their enumeration of what makes this possible: \u201cMandiant observed that the binaries on IoT devices processing Kalay data typically ran as the privileged user root and lacked common binary protections such as Address Space Layout Randomization (\u201cASLR\u201d), Platform Independent Execution (\u201cPIE\u201d), stack canaries, and NX bits.\u201d\n\nThe figure below shows a hypothetical attack using the captured Kalay credentials to stage yet another attack by abusing the vulnerabilities in the Kalay RPC interface: https://media.threatpost.com/wp-content/uploads/sites/103/2021/08/17114402/Screen-Shot-2021-08-17-at-11.43.08-AM-e1629215096109.png See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerMandiant isn\u2019t releasing public exploit code, but it did provide the video below, which demonstrates a proof of concept for CVE-2021-28372. How to Address the BugMandiant \u201cstrongly recommends\u201d that companies using the Kalay platform follow the following guidance from ThroughTek and Mandiant:\n\n* If the implemented SDK is below version 3.1.10, upgrade the library to version 3.3.1.0 or version 3.4.2.0 and enable the Authkey and Datagram Transport Layer Security (DTLS) features provided by the Kalay platform.\n* If the implemented SDK is version 3.1.10 and above, enable Authkey and DTLS.\n* Review security controls in place on APIs or other services that return Kalay unique identifiers (UIDs).\n* Hardening features such as ASLR, PIE, NX, and stack canaries should be enabled on all binaries processing Kalay data and RPC functions should be treated as untrusted and sanitized appropriately.\n* IoT device manufactures should apply stringent controls around web APIs used to obtain Kalay UIDs, usernames, and passwords to minimize an attacker\u2019s ability to harvest sensitive materials needed to access devices remotely. Failure to protect web APIs which return valid Kalay UIDs could allow an attacker to compromise a large number of devices.\n\nMandiant thanked ThroughTek and CISA for their cooperation and support with releasing the advisory and for their \u201ccommitment to securing IoT devices globally.\u201d\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Steam-logo-90x90.jpg Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/tmobile-header-90x90.webp Hacker claims to steal data of 100 million T-mobile customers2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/depositphotos_40325161-stock-photo-microsoft-building-90x90.jpg Microsoft Warns: Another Unpatched PrintNightmare Zero-Day5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/crypto-hack-90x90.jpg Crypto Hack Earned Crooks $600 Million6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/msft-microsoft-logo-2-3-90x90.webp Actively Exploited Windows Zero-Day Gets a Patch1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/botnet-90x90.jpg Auth Bypass Bug Exploited, Affecting Millions of Routers1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/cisco-patch-90x90.png Critical Cisco Bug in VPN Routers Allows Remote Takeover1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/delete-telegram-message-e1628177080[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:01.550066Z"}, {"uuid": "ad914d25-727f-4a8f-bce8-22c03617ffab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28372", "type": "seen", "source": "https://t.me/cissp/4040", "content": "exploit\nInteger Overflow to RCE - ManageEngine Asset Explorer Agent (CVE-2021-20082)\ud83d\ude2c\nhttps://medium.com/tenable-techblog/integer-overflow-to-rce-manageengine-asset-explorer-agent-cve-2021-20082-7e54cb2caad5\n\nThreat Research\n1. ThroughTek \"Kalay\" Protocol Vulnerability (CVE-2021-28372)\nhttps://www.fireeye.com/blog/threat-research/2021/08/mandiant-discloses-critical-vulnerability-affecting-iot-devices.html\n\nOffensive security\nExecuting Code In Context Of A Trusted Agent (Part 1) - Windows Defender Antivirus\nhttps://halove23.blogspot.com/2021/08/executing-code-in-context-of-trusted.html?m=1\n]-> PoC:\nhttps://github.com/klinix5/WinDefendInjectPoC", "creation_timestamp": "2026-09-02T01:04:29.092618Z"}, {"uuid": "d615daf3-b151-46b0-9f75-782de05228b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28372", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/20614", "content": "ntent/uploads/sites/103/2021/08/17113113/capturing-credentials-e1629214353657.png Attacker exploiting device personation vulnerability to capture credentials. Source: Mandiant.\nAfter that, a threat actor can remotely connect to the victimized device, access audio/visual data and execute remote procedure calls (RPC), Mandiant said. Due to vulnerabilities in the device-implemented RPC interface, this can then lead to \u201cfully remote and complete device compromise,\u201d researchers described. Their enumeration of what makes this possible: \u201cMandiant observed that the binaries on IoT devices processing Kalay data typically ran as the privileged user root and lacked common binary protections such as Address Space Layout Randomization (\u201cASLR\u201d), Platform Independent Execution (\u201cPIE\u201d), stack canaries, and NX bits.\u201d\n\nThe figure below shows a hypothetical attack using the captured Kalay credentials to stage yet another attack by abusing the vulnerabilities in the Kalay RPC interface: https://media.threatpost.com/wp-content/uploads/sites/103/2021/08/17114402/Screen-Shot-2021-08-17-at-11.43.08-AM-e1629215096109.png See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerMandiant isn\u2019t releasing public exploit code, but it did provide the video below, which demonstrates a proof of concept for CVE-2021-28372. How to Address the BugMandiant \u201cstrongly recommends\u201d that companies using the Kalay platform follow the following guidance from ThroughTek and Mandiant:\n\n* If the implemented SDK is below version 3.1.10, upgrade the library to version 3.3.1.0 or version 3.4.2.0 and enable the Authkey and Datagram Transport Layer Security (DTLS) features provided by the Kalay platform.\n* If the implemented SDK is version 3.1.10 and above, enable Authkey and DTLS.\n* Review security controls in place on APIs or other services that return Kalay unique identifiers (UIDs).\n* Hardening features such as ASLR, PIE, NX, and stack canaries should be enabled on all binaries processing Kalay data and RPC functions should be treated as untrusted and sanitized appropriately.\n* IoT device manufactures should apply stringent controls around web APIs used to obtain Kalay UIDs, usernames, and passwords to minimize an attacker\u2019s ability to harvest sensitive materials needed to access devices remotely. Failure to protect web APIs which return valid Kalay UIDs could allow an attacker to compromise a large number of devices.\n\nMandiant thanked ThroughTek and CISA for their cooperation and support with releasing the advisory and for their \u201ccommitment to securing IoT devices globally.\u201d\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Steam-logo-90x90.jpg Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/tmobile-header-90x90.webp Hacker claims to steal data of 100 million T-mobile customers2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/depositphotos_40325161-stock-photo-microsoft-building-90x90.jpg Microsoft Warns: Another Unpatched PrintNightmare Zero-Day5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/crypto-hack-90x90.jpg Crypto Hack Earned Crooks $600 Million6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/msft-microsoft-logo-2-3-90x90.webp Actively Exploited Windows Zero-Day Gets a Patch1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/botnet-90x90.jpg Auth Bypass Bug Exploited, Affecting Millions of Routers1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/cisco-patch-90x90.png Critical Cisco Bug in VPN Routers Allows Remote Takeover1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/delete-telegram-message-e1628177080[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T19:00:04.320894Z"}, {"uuid": "847a31aa-503d-460b-93aa-6cc3e9b0eea0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28372", "type": "seen", "source": "https://t.me/hacking_Attack/20612", "content": "Black Hat Ethical Hacking\nBug in Millions of Flawed IoT Devices Lets Attackers Eavesdrop\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Bug in Millions of Flawed IoT Devices Lets Attackers EavesdropPost Views: 84 \nReading Time: 3 Minutes\nA remote attacker could exploit a critical vulnerability to eavesdrop on live audio & video or take control. The bug is in ThroughTek\u2019s Kalay network, used in 83m devices.\nSecurity researchers have discovered a critical flaw that affects tens of millions of internet-of-things (IoT) devices \u2013 one that exposes live video and audio streams to eavesdropping threat actors and which could enable attackers to take over control of devices, including security webcams and connected baby monitors.\n\nThe flaw, tracked as CVE-2021-28372\u00a0and FEYE-2021-0020\u00a0and assigned a critical CVSS3.1 base score of 9.6, was found in devices connected via ThroughTek\u2019s Kalay IoT cloud platform.\n\nThe alarm was sounded on Tuesday by Mandiant, in coordination with the Cybersecurity and Infrastructure Security Agency (CISA) and ThroughTek. Mandiant\u2019s Red Team discovered the vulnerability in late 2020.\n\n\u201cCVE-2021-28372 poses a huge risk to an end user\u2019s security and privacy and should be mitigated appropriately,\u201d according to Mandiant\u2019s post. \u201cUnprotected devices, such as IoT cameras, can be compromised remotely with access to a UID and further attacks are possible depending on the functionality exposed by a device.\u201d\n\nThe world has already been inundated with tales of what can happen when these kind of devices are misconfigured or riddled with vulnerabilities, and this just adds to the growing pile of scary headlines. For example, in February, a vulnerability affecting multiple baby monitors was found to expose hundreds of thousands of live devices, potentially allowing someone to drop in and view a camera\u2019s video stream.\n\nAs Mandiant explained, the flaw would enable adversaries \u201cto remotely compromise victim IoT devices, resulting in the ability to listen to live audio, watch real time video data, and compromise device credentials for further attacks based on exposed device functionality. These further attacks could include actions that would allow an adversary to remotely control affected devices.\u201d\n\nIn a Tuesday post, researchers Jake Valletta, Erik Barzdukas and Dillon Franke \u2013 who discovered the bug \u2013 explained that it\u2019s impossible to compile a comprehensive list of companies and products affected, given how the Kalay protocol is integrated by manufacturers and resellers before devices reach consumers. Though they couldn\u2019t come up with a definitive list of affected companies and products that implement the Kalay platform, they strongly advised users of IoT devices \u201cto keep device software and applications up to date and use complex, unique passwords for any accounts associated with these devices.\u201d\nSee Also: Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets Mandiant also recommends that device owners avoid connecting to affected devices from untrusted networks, such as public Wi-Fi: a recommendation that\u2019s already part of wireless best practices, as the National Security Agency (NSA) recently advised\u00a0in a public service announcement (PDF). Kalay: A Newly Unappealing HandshakeAccording to ThroughTek, \u201cKalay\u201d is an indigenous Dawu\u00a0word that means \u201chandshake,\u201d \u201csymbolizing the universal link in an interconnected world.\u201d\n\nThroughTek implements that handshake \u2013 the Kalay protocol \u2013 as a software development kit (SDK). The Kalay SDK provides a plug-and-play network to easily connect smart devices with corresponding mobile apps.\n\nThe researchers provided an illustration that g[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T19:00:04.370531Z"}, {"uuid": "cd99f485-8f2b-476a-831e-781f35d41667", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28372", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/20614", "content": "ntent/uploads/sites/103/2021/08/17113113/capturing-credentials-e1629214353657.png Attacker exploiting device personation vulnerability to capture credentials. Source: Mandiant.\nAfter that, a threat actor can remotely connect to the victimized device, access audio/visual data and execute remote procedure calls (RPC), Mandiant said. Due to vulnerabilities in the device-implemented RPC interface, this can then lead to \u201cfully remote and complete device compromise,\u201d researchers described. Their enumeration of what makes this possible: \u201cMandiant observed that the binaries on IoT devices processing Kalay data typically ran as the privileged user root and lacked common binary protections such as Address Space Layout Randomization (\u201cASLR\u201d), Platform Independent Execution (\u201cPIE\u201d), stack canaries, and NX bits.\u201d\n\nThe figure below shows a hypothetical attack using the captured Kalay credentials to stage yet another attack by abusing the vulnerabilities in the Kalay RPC interface: https://media.threatpost.com/wp-content/uploads/sites/103/2021/08/17114402/Screen-Shot-2021-08-17-at-11.43.08-AM-e1629215096109.png See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerMandiant isn\u2019t releasing public exploit code, but it did provide the video below, which demonstrates a proof of concept for CVE-2021-28372. How to Address the BugMandiant \u201cstrongly recommends\u201d that companies using the Kalay platform follow the following guidance from ThroughTek and Mandiant:\n\n* If the implemented SDK is below version 3.1.10, upgrade the library to version 3.3.1.0 or version 3.4.2.0 and enable the Authkey and Datagram Transport Layer Security (DTLS) features provided by the Kalay platform.\n* If the implemented SDK is version 3.1.10 and above, enable Authkey and DTLS.\n* Review security controls in place on APIs or other services that return Kalay unique identifiers (UIDs).\n* Hardening features such as ASLR, PIE, NX, and stack canaries should be enabled on all binaries processing Kalay data and RPC functions should be treated as untrusted and sanitized appropriately.\n* IoT device manufactures should apply stringent controls around web APIs used to obtain Kalay UIDs, usernames, and passwords to minimize an attacker\u2019s ability to harvest sensitive materials needed to access devices remotely. Failure to protect web APIs which return valid Kalay UIDs could allow an attacker to compromise a large number of devices.\n\nMandiant thanked ThroughTek and CISA for their cooperation and support with releasing the advisory and for their \u201ccommitment to securing IoT devices globally.\u201d\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Steam-logo-90x90.jpg Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/tmobile-header-90x90.webp Hacker claims to steal data of 100 million T-mobile customers2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/depositphotos_40325161-stock-photo-microsoft-building-90x90.jpg Microsoft Warns: Another Unpatched PrintNightmare Zero-Day5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/crypto-hack-90x90.jpg Crypto Hack Earned Crooks $600 Million6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/msft-microsoft-logo-2-3-90x90.webp Actively Exploited Windows Zero-Day Gets a Patch1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/botnet-90x90.jpg Auth Bypass Bug Exploited, Affecting Millions of Routers1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/cisco-patch-90x90.png Critical Cisco Bug in VPN Routers Allows Remote Takeover1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/delete-telegram-message-e1628177080[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:27.596495Z"}, {"uuid": "db4cdc55-ba6c-42cf-9168-a0f404dcc835", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28372", "type": "seen", "source": "https://t.me/hacking_Attack/20612", "content": "Black Hat Ethical Hacking\nBug in Millions of Flawed IoT Devices Lets Attackers Eavesdrop\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Bug in Millions of Flawed IoT Devices Lets Attackers EavesdropPost Views: 84 \nReading Time: 3 Minutes\nA remote attacker could exploit a critical vulnerability to eavesdrop on live audio & video or take control. The bug is in ThroughTek\u2019s Kalay network, used in 83m devices.\nSecurity researchers have discovered a critical flaw that affects tens of millions of internet-of-things (IoT) devices \u2013 one that exposes live video and audio streams to eavesdropping threat actors and which could enable attackers to take over control of devices, including security webcams and connected baby monitors.\n\nThe flaw, tracked as CVE-2021-28372\u00a0and FEYE-2021-0020\u00a0and assigned a critical CVSS3.1 base score of 9.6, was found in devices connected via ThroughTek\u2019s Kalay IoT cloud platform.\n\nThe alarm was sounded on Tuesday by Mandiant, in coordination with the Cybersecurity and Infrastructure Security Agency (CISA) and ThroughTek. Mandiant\u2019s Red Team discovered the vulnerability in late 2020.\n\n\u201cCVE-2021-28372 poses a huge risk to an end user\u2019s security and privacy and should be mitigated appropriately,\u201d according to Mandiant\u2019s post. \u201cUnprotected devices, such as IoT cameras, can be compromised remotely with access to a UID and further attacks are possible depending on the functionality exposed by a device.\u201d\n\nThe world has already been inundated with tales of what can happen when these kind of devices are misconfigured or riddled with vulnerabilities, and this just adds to the growing pile of scary headlines. For example, in February, a vulnerability affecting multiple baby monitors was found to expose hundreds of thousands of live devices, potentially allowing someone to drop in and view a camera\u2019s video stream.\n\nAs Mandiant explained, the flaw would enable adversaries \u201cto remotely compromise victim IoT devices, resulting in the ability to listen to live audio, watch real time video data, and compromise device credentials for further attacks based on exposed device functionality. These further attacks could include actions that would allow an adversary to remotely control affected devices.\u201d\n\nIn a Tuesday post, researchers Jake Valletta, Erik Barzdukas and Dillon Franke \u2013 who discovered the bug \u2013 explained that it\u2019s impossible to compile a comprehensive list of companies and products affected, given how the Kalay protocol is integrated by manufacturers and resellers before devices reach consumers. Though they couldn\u2019t come up with a definitive list of affected companies and products that implement the Kalay platform, they strongly advised users of IoT devices \u201cto keep device software and applications up to date and use complex, unique passwords for any accounts associated with these devices.\u201d\nSee Also: Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets Mandiant also recommends that device owners avoid connecting to affected devices from untrusted networks, such as public Wi-Fi: a recommendation that\u2019s already part of wireless best practices, as the National Security Agency (NSA) recently advised\u00a0in a public service announcement (PDF). Kalay: A Newly Unappealing HandshakeAccording to ThroughTek, \u201cKalay\u201d is an indigenous Dawu\u00a0word that means \u201chandshake,\u201d \u201csymbolizing the universal link in an interconnected world.\u201d\n\nThroughTek implements that handshake \u2013 the Kalay protocol \u2013 as a software development kit (SDK). The Kalay SDK provides a plug-and-play network to easily connect smart devices with corresponding mobile apps.\n\nThe researchers provided an illustration that g[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:27.644018Z"}, {"uuid": "98d62b76-bbd3-48d6-85c3-c3a99f9d84ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28372", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4040", "content": "exploit\nInteger Overflow to RCE - ManageEngine Asset Explorer Agent (CVE-2021-20082)\ud83d\ude2c\nhttps://medium.com/tenable-techblog/integer-overflow-to-rce-manageengine-asset-explorer-agent-cve-2021-20082-7e54cb2caad5\n\nThreat Research\n1. ThroughTek \"Kalay\" Protocol Vulnerability (CVE-2021-28372)\nhttps://www.fireeye.com/blog/threat-research/2021/08/mandiant-discloses-critical-vulnerability-affecting-iot-devices.html\n\nOffensive security\nExecuting Code In Context Of A Trusted Agent (Part 1) - Windows Defender Antivirus\nhttps://halove23.blogspot.com/2021/08/executing-code-in-context-of-trusted.html?m=1\n]-> PoC:\nhttps://github.com/klinix5/WinDefendInjectPoC", "creation_timestamp": "2026-09-10T22:00:03.315122Z"}, {"uuid": "b78bca09-d624-456e-83b2-7d64565dc075", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28372", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4040", "content": "exploit\nInteger Overflow to RCE - ManageEngine Asset Explorer Agent (CVE-2021-20082)\ud83d\ude2c\nhttps://medium.com/tenable-techblog/integer-overflow-to-rce-manageengine-asset-explorer-agent-cve-2021-20082-7e54cb2caad5\n\nThreat Research\n1. ThroughTek \"Kalay\" Protocol Vulnerability (CVE-2021-28372)\nhttps://www.fireeye.com/blog/threat-research/2021/08/mandiant-discloses-critical-vulnerability-affecting-iot-devices.html\n\nOffensive security\nExecuting Code In Context Of A Trusted Agent (Part 1) - Windows Defender Antivirus\nhttps://halove23.blogspot.com/2021/08/executing-code-in-context-of-trusted.html?m=1\n]-> PoC:\nhttps://github.com/klinix5/WinDefendInjectPoC", "creation_timestamp": "2026-09-11T00:00:11.050218Z"}]}