# Cve-2021-32934 **URL:** \ **Category:** Cameras\ **Tags:** android\ **Created:** [June 16, 2021, 6:56pm UTC](https://forums.wyze.com/t/cve-2021-32934/186096 "2021-06-16T18:56:51Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![cnice](https://avatars.discourse-cdn.com/v4/letter/c/f07891/32.png) [@cnice](https://forums.wyze.com/u/cnice)\ **Post date:** [June 16, 2021, 6:56pm UTC](https://forums.wyze.com/t/cve-2021-32934/186096/1 "2021-06-16T18:56:51Z")
just read an article on a supply chain component vulnerability. Anyone know if this component is used on devices or apps ? [Millions of Connected Cameras Open to Eavesdropping | Threatpost](https://threatpost.com/millions-connected-cameras-eavesdropping/166950/). ---
**Author:** ![Customer](https://avatars.discourse-cdn.com/v4/letter/c/e19b73/32.png) [@Customer](https://forums.wyze.com/u/Customer)\ **Post date:** [June 17, 2021, 5:28am UTC](https://forums.wyze.com/t/cve-2021-32934/186096/2 "2021-06-17T05:28:24Z")
Sure sounds like it! Wyze uses ThroughTek as its P2P service for all of our cameras. This is relevant news, thanks. > **Vulnerable P2P SDK** > The ThroughTek component at issue is its peer-to-peer (P2P) software development kit (SDK), which has been installed in several million connected devices, [according to the supplier](https://www.throughtek.com/about-us/). It’s used to provide remote access to audio and video streams over the internet. > Nozomi Networks, which discovered the bug, noted that the way P2P works is based on three architectural aspects: > - A network video recorder (NVR), which is connected to security cameras and represents the local P2P server that generates the audio/video stream. - An offsite P2P server, managed by the camera vendor or P2P SDK vendor. This server acts as a middleman, allowing the client and NVR to establish a connection to each other. > - A software client, either a mobile or a desktop application, that accesses the audio/video stream from the internet. > “A peculiarity of P2P SDKs…is that OEMs are not just licensing a P2P software library,” analysts at Nozomi Networks pointed out, in a Tuesday posting. “They also receive infrastructure services (the offsite P2P server) for authenticating clients and servers and handling the audio/video stream.” > In analyzing the specific client implementation for ThroughTek’s P2P platform and the network traffic generated by a Windows client connecting to the NVR through P2P, Nozomi researchers found that the data transferred between the local device and ThroughTek servers lacked a secure key exchange, relying instead on an obfuscation scheme based on a fixed key. > “After setting a few breakpoints in the right spots, we managed to identify interesting code where the network’s packet payload is de-obfuscated,” according to [Nozomi’s writeup](https://www.nozominetworks.com/blog/new-iot-security-risk-throughtek-p2p-supply-chain-vulnerability/). “Since this traffic traverses the internet, an attacker that is able to access it can reconstruct the audio/video stream.” ---
**Author:** ![Customer](https://avatars.discourse-cdn.com/v4/letter/c/e19b73/32.png) [@Customer](https://forums.wyze.com/u/Customer)\ **Post date:** [July 25, 2021, 3:59pm UTC](https://forums.wyze.com/t/cve-2021-32934/186096/3 "2021-07-25T15:59:58Z")
Strange we haven’t heard more about this as it applies to Wyze. It was assigned the identifier ICSA-21-166-01 by the US government. I came across this article… [https://www.nozominetworks.com/blog/new-iot-security-risk-throughtek-p2p-supply-chain-vulnerability/](https://www.nozominetworks.com/blog/new-iot-security-risk-throughtek-p2p-supply-chain-vulnerability/) > **[ThroughTek P2P SDK | CISA](https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-01)** > > 1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: ThroughTek Equipment: P2P SDK Vulnerability: Cleartext Transmission of Sensitive Information 2. RISK EVALUATION ThroughTek supplies multiple original... Are Wyze cameras, old firmware or new, currently affected? ---
**Author:** ![WildBill](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/wildbill/32/41408_2.png) [@WildBill](https://forums.wyze.com/u/WildBill)\ **Post date:** [July 25, 2021, 10:37pm UTC](https://forums.wyze.com/t/cve-2021-32934/186096/4 "2021-07-25T22:37:52Z")
Excellent question…I think you should contact Wyze support… 🤣 ---
**Author:** ![spamoni](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/spamoni/32/34695_2.png) [@spamoni](https://forums.wyze.com/u/spamoni)\ **Post date:** [July 26, 2021, 12:13am UTC](https://forums.wyze.com/t/cve-2021-32934/186096/5 "2021-07-26T00:13:40Z")
you should ask this at the upcoming CamPlus session. ---
**Author:** ![peepeep](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/peepeep/32/107148_2.png) [@peepeep](https://forums.wyze.com/u/peepeep)\ **Post date:** [July 26, 2021, 7:33pm UTC](https://forums.wyze.com/t/cve-2021-32934/186096/6 "2021-07-26T19:33:19Z")
Hi @cnice You might want to change the Topic title to: **Millions of Connected Cameras Open to Eavesdropping - Cve-2021-32934** or such like. Will definitely get more traffic and possibly staff attention. (Click the pencil icon at the end of the current title to edit it.) Cheers -peep ---
**Author:** ![bryonhu](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/bryonhu/32/122736_2.png) [@bryonhu](https://forums.wyze.com/u/bryonhu)\ **Post date:** [July 26, 2021, 8:46pm UTC](https://forums.wyze.com/t/cve-2021-32934/186096/7 "2021-07-26T20:46:58Z")
I flagged it yesterday for Wyze staff to answer if this affects our Wyze cams. ---
**Author:** ![Antonius](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/antonius/32/106761_2.png) [@Antonius](https://forums.wyze.com/u/Antonius)\ **Post date:** [July 26, 2021, 11:07pm UTC](https://forums.wyze.com/t/cve-2021-32934/186096/8 "2021-07-26T23:07:41Z")
😲 😲 😲 😲 Someone is going to see all my raccoon videos 🙃 [https://us1.discourse-cdn.com/wyze/original/3X/7/5/7581a3aff911398312ec3ce905c85a407817a908.mp4](https://us1.discourse-cdn.com/wyze/original/3X/7/5/7581a3aff911398312ec3ce905c85a407817a908.mp4) ---
**Author:** ![bryonhu](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/bryonhu/32/122736_2.png) [@bryonhu](https://forums.wyze.com/u/bryonhu)\ **Post date:** [July 27, 2021, 10:13pm UTC](https://forums.wyze.com/t/cve-2021-32934/186096/9 "2021-07-27T22:13:36Z")
Still no reply from Wyze Staff, this is concerning. If we are not affected they would have chimed in by now. I will assume this does affect Wyze Cams until told differently from a Wyze staff member ---
**Author:** ![bryonhu](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/bryonhu/32/122736_2.png) [@bryonhu](https://forums.wyze.com/u/bryonhu)\ **Post date:** [July 28, 2021, 2:47am UTC](https://forums.wyze.com/t/cve-2021-32934/186096/10 "2021-07-28T02:47:27Z")
There was a post about a very serious security concern but the title needed more clarity to be noticed. Wyze Staff needs to address this issue Please see this post [Cve-2021-32934](https://forums.wyze.com/t/cve-2021-32934/186096) ---
**Author:** ![bryonhu](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/bryonhu/32/122736_2.png) [@bryonhu](https://forums.wyze.com/u/bryonhu)\ **Post date:** [July 28, 2021, 4:51am UTC](https://forums.wyze.com/t/cve-2021-32934/186096/11 "2021-07-28T04:51:13Z")
Wonder when Wyze will comment on this security issue? ---
**Author:** ![gemniii](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/gemniii/32/5776_2.png) [@gemniii](https://forums.wyze.com/u/gemniii)\ **Post date:** [July 28, 2021, 12:18pm UTC](https://forums.wyze.com/t/cve-2021-32934/186096/12 "2021-07-28T12:18:07Z")
ANY data transferred over the internet is subject to hacking. ---
**Author:** ![Customer](https://avatars.discourse-cdn.com/v4/letter/c/e19b73/32.png) [@Customer](https://forums.wyze.com/u/Customer)\ **Post date:** [July 29, 2021, 12:12pm UTC](https://forums.wyze.com/t/cve-2021-32934/186096/15 "2021-07-29T12:12:02Z")
True but that’s like saying any lock can be broken or any person defeated or any food overeaten. This is about a specific identified vulnerability that may or may not apply to us Wyze users. ---
**Author:** ![bryonhu](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/bryonhu/32/122736_2.png) [@bryonhu](https://forums.wyze.com/u/bryonhu)\ **Post date:** [July 30, 2021, 6:32pm UTC](https://forums.wyze.com/t/cve-2021-32934/186096/16 "2021-07-30T18:32:18Z")
And Wyze staff has failed to even comment on this subject, and it was flagged for their attention… Just Crickets… ---
**Author:** ![peepeep](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/peepeep/32/107148_2.png) [@peepeep](https://forums.wyze.com/u/peepeep)\ **Post date:** [August 3, 2021, 4:57pm UTC](https://forums.wyze.com/t/cve-2021-32934/186096/17 "2021-08-03T16:57:19Z")
Hey @bryonhu … Man, you’ve been a member (almost) since Wyze’ inception! 🙂 In the past, when you’ve flagged a topic for staff attention have you received either a public or personal response? I haven’t done it for years but I often received a private message, I think. ![image](https://us1.discourse-cdn.com/wyze/original/3X/b/d/bd6fee88594375be05c0494db8a7d8680623b488.png) FYI, as discussed in another topic: > [@Wyze is a Chinese Company ( Discussion Continued)](https://forums.wyze.com/t/wyze-is-a-chinese-company-discussion-continued/190391/155): > > I do think it would be prudent for someone from Wyze to at least reassure people that they are aware of the release and provide some information or plans they’ve taken to remain secure. I certainly don’t disagree with that. If I worked for or consulted with Wyze, I would have recommended this. > [@Wyze is a Chinese Company ( Discussion Continued)](https://forums.wyze.com/t/wyze-is-a-chinese-company-discussion-continued/190391/151): > > Wyze may not want to talk about the specifics of what TUTK SDK version and options they have enabled or not…but since they’ve been doing so many AMA’s lately, if someone reminds me, I have no problem asking them in the next AMA. They answered at least half a dozen of my questions in the last AMA, even about stuff like Hualai. I’ll happily ask them about TUTK and WebRTC in the next one if you or someone will PM or callsign a reminder to me right around that time to remind me. ---
**Author:** ![bryonhu](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/bryonhu/32/122736_2.png) [@bryonhu](https://forums.wyze.com/u/bryonhu)\ **Post date:** [August 4, 2021, 4:16am UTC](https://forums.wyze.com/t/cve-2021-32934/186096/18 "2021-08-04T04:16:53Z")
In the past back when they were only a camera producer only, V1. V2, and Pan Cam they were more responsive and addressed issues that were directed to Wyze Staff. Since they went crazy on new products releases they do seem far less responsive to questions/issues directed to Wyze Staff. Guess they are to busy working on the Wyze WiFi-Bluetooth Toilet to answer us on a Critical Security Concern. Maybe they know it is a issue and won’t address it until they have a solution, rather than reveal to the Interwebz that they are vulnerable. But their Lack of Response tells me they are vulnerable in my opinion. ---
**Author:** ![peepeep](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/peepeep/32/107148_2.png) [@peepeep](https://forums.wyze.com/u/peepeep)\ **Post date:** [August 4, 2021, 3:46pm UTC](https://forums.wyze.com/t/cve-2021-32934/186096/19 "2021-08-04T15:46:25Z")
I throw in valuable factoid keying off single word: - Roaches can hold their breath underwater for 30-40 minutes. I don’t know what Wyze can do about that, but there it is. ---
**Author:** ![bryonhu](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/bryonhu/32/122736_2.png) [@bryonhu](https://forums.wyze.com/u/bryonhu)\ **Post date:** [August 4, 2021, 8:24pm UTC](https://forums.wyze.com/t/cve-2021-32934/186096/20 "2021-08-04T20:24:20Z")
I now have sent a DM to WyzeGwendolyn hopefully she will answer back on this, fingers crossed… ![DM WyzeGwendolyn](https://us1.discourse-cdn.com/wyze/original/3X/0/6/06a0f73879876880a94caf56d9db46ecec39bcd3.png) ---
**Author:** ![Customer](https://avatars.discourse-cdn.com/v4/letter/c/e19b73/32.png) [@Customer](https://forums.wyze.com/u/Customer)\ **Post date:** [August 5, 2021, 12:05am UTC](https://forums.wyze.com/t/cve-2021-32934/186096/21 "2021-08-05T00:05:52Z")
Great, hope that helps, and hope it’s nothing in the end. ---
**Author:** ![bryonhu](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/bryonhu/32/122736_2.png) [@bryonhu](https://forums.wyze.com/u/bryonhu)\ **Post date:** [August 5, 2021, 12:54am UTC](https://forums.wyze.com/t/cve-2021-32934/186096/22 "2021-08-05T00:54:17Z")
Apparently NOT, Question was posed in the WyzeGwendolyn post [Wyze App 2.23 and Wyze Sense Hub 4.32.4.295 Released - 8/4/21](https://forums.wyze.com/t/wyze-app-2-23-and-wyze-sense-hub-4-32-4-295-released-8-4-21/191858) And she replied to other question about Geo-Location. But Just the Same CRICKETS in response to this. [Next page](https://forums.wyze.com/t/cve-2021-32934/186096.md?page=2)