CVE-2023-6322 is a High severity (CVSS 7.2) flaw in the message parsing code of the Roku Indoor Camera SE (firmware 3.0.2.4679) and Wyze Cam v3 (firmware 4.36.11.5859). A crafted message can cause a stack based buffer overflow, if the attacker is authenticated. Install the latest firmware from the device maker.
What's affected
The NVD record and Bitdefender's report give the details.
- Affected: Roku Indoor Camera SE firmware 3.0.2.4679 and Wyze Cam v3 firmware 4.36.11.5859, the versions named in the record.
- Fixed: the record names no fixed version. Bitdefender says the vendor confirmed that all affected SDK versions were patched, so look for newer firmware from Roku and Wyze.
- Severity: CVSS 7.2 High per the NVD record.
Bitdefender's report covers four flaws in devices built on the ThroughTek Kalay platform, which it says powers more than 100 million devices and is common in surveillance cameras. It says the vendor confirmed on 16 April 2024 that all affected SDK versions were patched, and that the report went public on 15 May 2024.
How to check if you're exposed
Cameras are easy to lose track of, so start with a list.
- Count cameras and baby monitors on the network by model, using the router or DHCP lease table, or the manufacturer's app.
- Read the firmware version in the app or the device's settings page, and compare with the version in this post and the maker's release notes.
- Check which devices have port forwards or UPnP mappings on your router, and remove any you did not set up on purpose.
- Confirm automatic updates are on.
What to do now
- Install the latest firmware for your camera from the maker's app or support page, and enable automatic updates.
- Keep cameras on a separate network from computers and servers, with no inbound port forwards from the internet.
- Use a strong, unique password for the device and the cloud account that controls it.
- Retire cameras that no longer receive firmware updates, because patches to the underlying SDK reach devices only through maker firmware.
- Record camera models and firmware versions in your inventory, including ones installed by individual teams.
Why it matters
The weaknesses are CWE-121, a stack based buffer overflow, and CWE-787, an out of bounds write. The description says a specially crafted message in the message parsing functionality can lead to the overflow, and the attacker needs to make authenticated requests.
Bitdefender's report says this gives root access through the handler of an IOCTL message, typically used to configure motion detection zones, and that it is specific to some devices that use motion detection features. Stack overflows on embedded devices without strong exploit mitigations can be more direct to turn into code execution than on desktop systems, which is why the vector assumes high impact. The kev flag is false and no exploitation in the wild is reported.
Quick check
Which firmware versions are named?
The record names Roku Indoor Camera SE 3.0.2.4679 and Wyze Cam v3 4.36.11.5859 as the tested versions.
Is every Kalay camera affected?
Bitdefender says this flaw is specific to some devices that use motion detection features.
Sources
Last reviewed: 19 October 2026.
