PT-2023-26679 · Tp Link · Tplink Smart Bulb Tapo Series L510E+4

Davide Bonaventura + 2 · Publicado 2023-09-25 · Atualizado 2024-05-07 · CVE-2023-38907

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TPLink Smart Bulb Tapo series L530 versions 1.0.0 through 1.2.3 TPLink Smart Bulb Tapo series L510E versions 1.0.0 through 1.0.9 TPLink Smart Bulb Tapo series L630 versions 1.0.0 through 1.0.3 TPLink Smart Bulb Tapo series P100 versions 1.0.0 through 1.4.9 Tapo Application versions 2.8.14 and earlier

Description An issue in TPLink Smart Bulb Tapo series allows a remote attacker to replay old messages encrypted with a still valid session key, potentially obtaining sensitive information via the session key in the message function.

Recommendations For TPLink Smart Bulb Tapo series L530 versions 1.0.0 through 1.2.3, update to version 1.2.4 or later. For TPLink Smart Bulb Tapo series L510E versions 1.0.0 through 1.0.9, update to version 1.1.0 or later. For TPLink Smart Bulb Tapo series L630 versions 1.0.0 through 1.0.3, update to version 1.0.4 or later. For TPLink Smart Bulb Tapo series P100 versions 1.0.0 through 1.4.9, update to version 1.5.0 or later. For Tapo Application versions 2.8.14 and earlier, update to a version later than 2.8.14.

Correção

Identificadores relacionados

CVE-2023-38907

Produtos afetados

Tplink Smart Bulb Tapo Series L510E

Tplink Smart Bulb Tapo Series L530

Tplink Smart Bulb Tapo Series L630

Tplink Smart Bulb Tapo Series P100

Tapo Application

Referências · 12

• https://dmi.unict.it/giamp/smartbulbscanbehackedtohackintoyourhousehold · Nota
• https://scitepress.org/Papers/2023/120929/120929.pdf · Nota
• https://arxiv.org/abs/2308.09019 · Nota
• https://twitter.com/CVEnew/status/1706435716069167492 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-38907 · Aviso do Fabricante
• https://t.me/cibsecurity/71029 · Publicação no Telegram
• https://scitepress.org/PublicationsDetail.aspx?ID=X/auBv7JrSo=&t=1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-38907 · Nota de Segurança
• https://t.me/cvenotify/58607 · Publicação no Telegram
• https://t.me/cvenotify/79425 · Publicação no Telegram
• https://t.me/cvenotify/58586 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1706470761978835440 · Publicação no Twitter