CVE-2023-6324 is a High severity (CVSS 8.1) flaw in the DTLS handling of the ThroughTek Kalay SDK used in the Roku Indoor Camera SE and Wyze Cam v3. The SDK uses a predictable pre-shared key when it sees an unexpected PSK identity. Install the latest firmware from the device maker.
What's affected
The NVD record and Bitdefender's report give the details.
- Affected: Roku Indoor Camera SE firmware 3.0.2.4679 and Wyze Cam v3 firmware 4.36.11.5859, the versions named in the record. The flaw is in the Kalay SDK, so other devices that use it may be affected.
- Fixed: the record names no fixed version. Bitdefender says the vendor confirmed that all affected SDK versions were patched.
- Severity: CVSS 8.1 High per the NVD record.
Bitdefender's report covers four flaws in devices built on the ThroughTek Kalay platform, which it says powers more than 100 million devices and is common in surveillance cameras. It says the vendor confirmed on 16 April 2024 that all affected SDK versions were patched, and that the report went public on 15 May 2024.
How to check if you're exposed
Cameras are easy to lose track of, so start with a list.
- Count cameras and baby monitors on the network by model, using the router or DHCP lease table, or the manufacturer's app.
- Read the firmware version in the app or the device's settings page, and compare with the version in this post and the maker's release notes.
- Check which devices have port forwards or UPnP mappings on your router, and remove any you did not set up on purpose.
- Confirm automatic updates are on.
What to do now
- Install the latest firmware for your camera from the maker's app or support page, and enable automatic updates.
- Keep cameras on a separate network from computers and servers, with no inbound port forwards from the internet.
- Use a strong, unique password for the device and the cloud account that controls it.
- Retire cameras that no longer receive firmware updates, because patches to the underlying SDK reach devices only through maker firmware.
- Record camera models and firmware versions in your inventory, including ones installed by individual teams.
Why it matters
The weaknesses are CWE-457, use of an uninitialized variable, and CWE-908, use of an uninitialized resource. The description says the SDK uses a predictable PSK value in the DTLS session when it encounters an unexpected PSK identity. In plain terms, a value that should be secret and random is not.
Bitdefender explains why this matters: the pre-shared key for the DTLS session is a prerequisite for connecting to and talking with the device, so being able to infer it lets an attacker start a conversation with a camera. Combined with the command injection and overflow bugs, the report says this allows root access from the local network. It describes remote code execution as possible only after the device has been probed from the local network. The kev flag is false.
Quick check
What does a predictable PSK allow?
It lets an attacker infer the key for a DTLS session, which is needed to connect to and talk with the device, per Bitdefender.
Which devices are named?
Roku Indoor Camera SE 3.0.2.4679 and Wyze Cam v3 4.36.11.5859 in the record.
Sources
Last reviewed: 19 October 2026.
