PT-2024-27692 · Tuya · Tuya Sdk

Kaizheng · Published 2024-04-14 · Updated 2024-08-01 · CVE-2024-3764

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Tuya SDK versions up to 5.0.x

Description A vulnerability has been found in the MQTT Packet Handler component, which can lead to denial of service. The attack can be launched remotely, but the vendor notes that a malicious actor would have to crack TLS first or use a legitimate login to initiate the attack. The real existence of this vulnerability is still doubted at the moment.

Recommendations For Tuya SDK versions up to 5.0.x, upgrade to version 5.1.0 to address this issue. As a temporary workaround, consider restricting access to the MQTT Packet Handler component until a patch is available.

Exploit

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2024-3764

Affected Products

Tuya Sdk

References · 8

• 🔥 https://github.com/kzLiu2017/Tuya_Cam_CVE_Doc/blob/main/CVE%20Doc.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-3764 · Security Note
• https://t.me/cvenotify/76704 · Telegram Post
• https://vuldb.com/?submit.311860 · Note
• https://vuldb.com/?ctiid.260604 · Note
• https://t.me/cvenotify/88342 · Telegram Post
• https://vuldb.com/?id.260604 · Note
• https://t.me/cvenotify/76898 · Telegram Post