CVE-2021-28372: Throughtek Kalay p2p Software Development Kit

High severity, CVSS 8.3. EPSS: 2.6% chance of exploitation in the next 30 days.

ThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek (TUTK) device given a valid 20-byte uniquely assigned identifier (UID). This could result in an attacker hijacking a victim's connection and forcing them into supplying credentials needed to access the victim TUTK device.

Affected products

• Throughtek Kalay p2p Software Development Kit: before 3.1.10 (fixed in 3.1.10)

Published 2021-08-17. Last modified 2026-06-17.