Critical · published May 19, 2022
🔥 An unprotected connection in ThroughTek P2P products could let anyone eavesdrop on your sensitive data, including camera feeds! Think of it like sending a postcard instead of a sealed letter — anyone can read what's written on that postcard, and it’s just floating out in the open for the world to see. An attacker could exploit this vulnerability to access private camera feeds and other sensitive information, potentially violating privacy and security. This could lead to absolutely devastating consequences for users, leaving them exposed and vulnerable.
Think of it like sending a postcard instead of a sealed letter — anyone can read what's written on that postcard, and it’s just floating out in the open for the world to see. This vulnerability arises from insufficient protection of data transfers between local devices and ThroughTek servers, allowing attackers to intercept sensitive information. Affected products include those using SDK versions prior to 3.1.5, and those with specific configurations that don’t enforce secure connections.
An attacker could exploit this vulnerability to access private camera feeds and other sensitive information, potentially violating privacy and security. This could lead to absolutely devastating consequences for users, leaving them exposed and vulnerable. To mitigate this risk, update to version 3.1.5 or later for SDKs, ensure all firmware uses AuthKey for IOTC connections, and enable DTLS for the AVAPI module. Additionally, review configurations to avoid using the nossl tag and disable P2PTunnel or RDT modules if not necessary. This is fixable! Follow these steps to keep your data safe and secure. 🛡️