The security problem impacts products from various manufacturers providing video and surveillance solutions as well as home automation IoT systems that use the Kalay network for easy connections  and communication with a corresponding app.

A remote attacker could use the bug to gain access to the live audio and video streams, or to take control of the vulnerable device.

Insecurity expects at Mandiant's Red Team discovered the vulnerability at the end of 2020 and worked with the US Cybersecurity and Infrastructure Security Agency and ThroughTek to coordinate the disclosure and create mitigation options.

Tracked as CVE-2021-28372, the issue is a device impersonation vulnerability that received a severity score of 9.6 out of 10. It affects the Kalay protocol that is implemented as a software development kit (SDK) that is built into mobile and desktop applications.

Mandiant's Jake Valletta, Erik Barzdukas, and Dillon Franke found that registering a device on the Kalay network required only the device's unique identifier (UID).

A Kalay client, such as a mobile app, usually receives the UID from a web API hosted by the vendor of the IoT device. An attacker with the UID of a target system could register on the Kalay network a device they control and receive all client connection attempts.

This would allow them to obtain the login credentials that provide remote access to the victim device audio-video data.

ThroughTek’s Kalay platform has more than 83 million active devices and manages over one billion connections every month.

Apparently, the best way to protect yourself from this vulnerability is to keep your device software and applications updated to the latest version, as well as create complex, unique login passwords.