CVE-2021-28372

ThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek...

8.3 High

CVE-2021-28372 is a high vulnerability (CVSS 8.3) in Throughtek Kalay P2p Software Development Kit, published August 17, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.55%, the 85th percentile. No source names a fixed version.

ThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek (TUTK) device given a valid 20-byte uniquely assigned identifier (UID). This could result in an attacker hijacking a victim's connection and forcing them into supplying credentials needed to access the victim TUTK device.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.55%Up 1.7 points since Aug 18, 2021

What each source reports

NVD Score used 8.3

Record: CVE-2021-28372
CVSS 3.1: 8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS 2.0: 7.6 HighAV:N/AC:H/Au:N/C:C/I:C/A:C
Weakness: CWE-290
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-28372
Updated: 2026-11-02

EUVDEUVD-2021-15055 No score

Record: EUVD-2021-15055
Updated: 2026-11-03

GitHub AdvisoriesGHSA-h5gx-r98q-mqhf No score

ThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek...

Record: GHSA-h5gx-r98q-mqhf
Weakness: CWE-290
Updated: 2026-11-02

Affected products

throughtek kalay p2p software development kit

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD