CVE-2023-6321 is a High severity (CVSS 7.2) flaw in the over the air update handler of Owlet Cam and Owlet Cam 2 devices. A crafted command sent through the IOCTL that manages OTA updates can run as root, if the attacker is authenticated. Install the latest firmware from the device maker.
What's affected
The NVD record and Bitdefender's report give the details.
- Affected: the Owlet Cam and Owlet Cam 2 firmware in the record's product list. The record gives no version number.
- Fixed: Bitdefender says the vendor confirmed that all affected SDK versions were patched. Firmware version numbers are not in the record, so use Owlet's update notes.
- Severity: CVSS 7.2 High per the NVD record.
Bitdefender's report covers four flaws in devices built on the ThroughTek Kalay platform, which it says powers more than 100 million devices and is common in surveillance cameras. It says the vendor confirmed on 16 April 2024 that all affected SDK versions were patched, and that the report went public on 15 May 2024.
How to check if you're exposed
Cameras are easy to lose track of, so start with a list.
- Count cameras and baby monitors on the network by model, using the router or DHCP lease table, or the manufacturer's app.
- Read the firmware version in the app or the device's settings page, and compare with the version in this post and the maker's release notes.
- Check which devices have port forwards or UPnP mappings on your router, and remove any you did not set up on purpose.
- Confirm automatic updates are on.
What to do now
- Install the latest firmware for your camera from the maker's app or support page, and enable automatic updates.
- Keep cameras on a separate network from computers and servers, with no inbound port forwards from the internet.
- Use a strong, unique password for the device and the cloud account that controls it.
- Retire cameras that no longer receive firmware updates, because patches to the underlying SDK reach devices only through maker firmware.
- Record camera models and firmware versions in your inventory, including ones installed by individual teams.
Why it matters
The weaknesses are CWE-77, command injection, and CWE-78, OS command injection. The description says a specially crafted command sent to the IOCTL that manages over the air updates can lead to command execution as the root user, and that the attacker must make authenticated requests.
Bitdefender says the result is full compromise of the device. It also notes that the four Kalay flaws can be chained: one helps an attacker learn the key material needed to talk to a camera, and another gives code execution. The report adds that remote code execution is only possible after the device has been probed from the local network. The kev flag is false, and the report describes responsible disclosure, not exploitation.
Quick check
Does this need a login?
The description says authenticated requests. Bitdefender notes other Kalay flaws in the same report that help an attacker connect to a device.
Who needs to update?
Owners of Owlet Cam and Owlet Cam 2 devices, through the maker's firmware update.
Sources
Last reviewed: 19 October 2026.
