Unpredictable PSK Values in DTLS Sessions

CVE-2023-6324

What is CVE-2023-6324?

The ThroughTek Kalay SDK is prone to a vulnerability due to its implementation of a predictable Pre-Shared Key (PSK) value in Datagram Transport Layer Security (DTLS) sessions when faced with an unexpected PSK identity. This flaw may allow unauthorized parties to exploit the connection, leading to potential security breaches and data exposure. It highlights a significant risk in the secure communication protocols utilized by applications relying on the Kalay SDK for digital streaming and connected devices, necessitating immediate attention and remediation.

References