CVE-2021-32934

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module) do not sufficiently protect data transferred between the local device and ThroughTek servers. This can allow an attacker to access sensitive information, such as camera feeds.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
ThroughTek	P2P SDK	all with nossl tag; firmware using AVAPI module without enabling DTLS mechanism; firmware using P2PTunnel or RDT module; >= All, <= 3.1.5

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-01Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-01Third Party Advisory, US Government Resource

Timeline

Published: May 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-329359.8The affected Cognex product, the In-Sight OPC Server versions v5.7.4 (96) and prior, deserializes untrusted data, which could allow a remote CVE-2021-329367.8An out-of-bounds write issue exists in the DXF file-recovering procedure in the Drawings SDK (All versions prior to 2022.4) resulting from t CVE-2021-329377.5An attacker can gain knowledge of a session temporary working folder where the getfile and putfile commands are used in MDT AutoSave version CVE-2021-329387.1Drawings SDK (All versions prior to 2022.4) are vulnerable to an out-of-bounds read due to parsing of DWG files resulting from the lack of p CVE-2021-329397.8FATEK Automation FvDesigner, Versions 1.5.88 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an a CVE-2021-32945.4CASAP Automated Enrollment System 1.0 is affected by cross-site scripting (XSS) in users.php. An attacker can steal a cookie to perform user CVE-2021-329407.1An out-of-bounds read issue exists in the DWG file-recovering procedure in the Drawings SDK (All versions prior to 2022.5) resulting from th CVE-2021-329419.8Annke N48PBB (Network Video Recorder) products of version 3.4.106 build 200422 and prior are vulnerable to a stack-based buffer overflow, wh CVE-2021-329425.5The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authoriz CVE-2021-329439.8The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code on the W CVE-2021-329447.8A use-after-free issue exists in the DGN file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack o CVE-2021-329457.5An attacker could decipher the encryption and gain access to MDT AutoSave versions prior to v6.02.06.