Vulnerability in TPLink Smart Bulb Tapo series Allows Remote Information Disclosure
CVE-2023-38909

6.5MEDIUM

Key Information:

Vendor
Tp-link
Status
Tapo
Tapo L530e Firmware
Vendor
CVE Published:
22 August 2023

Summary

A vulnerability exists in the TPLink Smart Bulb Tapo series allowing remote attackers to access sensitive information. This issue affects several models, including L530, L510E, L630, and P100, as well as the Tapo Application. The flaw arises from inadequate protection of the Initialization Vector (IV) used in the AES128-CBC encryption process, which could lead to the exposure of critical data. It is essential for users to update their devices to the latest firmware versions to mitigate potential risks.

References

https://www.scitepress.org/PublicationsDetail.aspx?ID=X/a...
https://arxiv.org/abs/2308.09019
https://arxiv.org/pdf/2308.09019.pdf

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.