Tuya SDK up to 5.0.x MQTT Packet denial of service ⚔ [Disputed]

Summaryinfo

A vulnerability categorized as problematic has been discovered in Tuya SDK up to 5.0.x. This vulnerability affects unknown code of the component MQTT Packet Handler. The manipulation results in denial of service. This vulnerability is cataloged as CVE-2024-3764. The attack may be launched remotely. Furthermore, there is an exploit available. The actual existence of this vulnerability is currently in question. It is advisable to upgrade the affected component. The vendor explains that a malicious actor would have to crack TLS first or use a legitimate login to initiate the attack.

Detailsinfo

A vulnerability classified as problematic has been found in Tuya SDK up to 5.0.x. Affected is an unknown functionality of the component MQTT Packet Handler. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2024-3764. The exploitability is told to be easy. It is possible to launch the attack remotely. Additional levels of successful authentication are needed for exploitation. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

The exploit is shared for download at github.com. It is declared as proof-of-concept. The real existence of this vulnerability is still doubted at the moment. The vendor explains that a malicious actor would have to crack TLS first or use a legitimate login to initiate the attack. The vendor explains: "In fact, MQTT data communication has two layers of encryption. The outermost layer is TLS encryption, and there is another layer of AES GCM mode encryption at the data layer. Moreover, the key is randomly generated each time the device is initialized for network configuration. Therefore, even if the currently recognized secure TLS is cracked, it is not possible to hijack MQTT messages for a man-in-the-middle attack. The only one who can send legitimate MQTT messages to the device is the device controller themselves."

Upgrading to version 5.1.0 eliminates this vulnerability. The vendor explains their viewpoint like this: "Since this functional bug cannot pose an actual security risk, we have determined that it does not constitute a security vulnerability."

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Tuya

Name

• SDK

Version

• 5.0

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #311860: Tuya camera firmware: 3.2.9 DoS (denial of service) (by kaizheng)

Once again VulDB remains the best source for vulnerability data.

Discussion