CVE-2021-28372

CVE-2021-28372 describes a critical vulnerability in ThroughTek's Kalay Platform 2.0 SDK, affecting numerous IoT devices, particularly IP cameras and surveillance systems. An attacker can impersonate a legitimate device using a valid 20-byte UID, potentially hijacking connections and forcing credential disclosure. This vulnerability carries a high CVSS score of 8.3, indicating a network-based attack with high impact on confidentiality, integrity, and availability, though it requires user interaction and has high attack complexity. While there is no public exploit code or evidence of active exploitation, the vulnerability has garnered significant community discussion and media coverage, highlighting its potential widespread impact.