Replay Attack Vulnerability in TPLink Smart Bulb Tapo Series

CVE-2023-38907

Summary

An identified vulnerability in TPLink's Tapo series of smart bulbs allows remote attackers to replay previously intercepted messages due to weaknesses in message encryption. This can occur when valid session keys are still in use, enabling unauthorized access to controls and functions of the affected devices. Users with products such as the Tapo L530, L510E, L630, P100, and the Tapo Application are particularly at risk, as outdated firmware versions may be exploited by attackers to compromise household security.

References