PT-2023-9141 · Owlet · Owlet Cam

Alexandru Lazar + 1 · Published 2023-10-23 · Updated 2024-07-08 · CVE-2023-6321

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Owlet Cam versions v1 and v2

Description A command injection vulnerability exists in the IOCTL that manages OTA updates, allowing a specially crafted command to lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability, potentially enabling remote execution of arbitrary commands and privilege escalation.

Recommendations For Owlet Cam version v1, upgrade the affected components immediately to mitigate the risk. For Owlet Cam version v2, upgrade the affected components immediately to mitigate the risk. As a temporary workaround, consider restricting access to the IOCTL handler that manages OTA updates until a patch is available.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2024-04018

CVE-2023-6321

Affected Products

Owlet Cam

References · 12

• 🔥 https://bitdefender.com/blog/labs/notes-on-throughtek-kalay-vulnerabilities-and-their-impact · Exploit
• https://bdu.fstec.ru/vul/2024-04018 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6321 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6321 · Security Note
• https://t.me/cvenotify/79846 · Telegram Post
• https://securityonline.info/millions-of-iot-devices-vulnerable-after-researchers-uncover-flaws-in-throughtek-kalay-platform · Note
• https://vuldb.com/ru/?id.264470 · Note
• https://globalsecuritymag.fr/vulnerabilities-identified-in-owlet-cam.html · Note
• https://twitter.com/oktsec/status/1810496474272190563 · Twitter Post
• https://t.me/true_secator/5748 · Telegram Post
• https://hackread.com/iot-cameras-exposed-by-chainable-exploits · Note
• https://fork.ai/technologies/intelligent-platform/tutk-iotc · Note