CVE-2023-38908: An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive infor...

Summary

An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via the TSKEP authentication function.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
tp-link	tapo	2.8.14 `cpe:2.3:a:tp-link:tapo:2.8.14:::::::*`
tp-link	tapo_l530e_firmware	1.0.0 `cpe:2.3:o:tp-link:tapo_l530e_firmware:1.0.0:::::::*`

Original advisory text

An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive infor...

An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via the TSKEP authentication function.

References

https://arxiv.org/abs/2308.09019 Third Party Advisory
https://arxiv.org/pdf/2308.09019.pdf Technical Description Third Party Advisory
https://www.dmi.unict.it/giamp/smartbulbscanbehackedtohackintoyourhousehold/
https://www.scitepress.org/Papers/2023/120929/120929.pdf
https://www.scitepress.org/PublicationsDetail.aspx?ID=X/auBv7JrSo=&t=1 Third Party Advisory