PT-2023-4545 · Tp Link · Tplink Smart Bulb Tapo Series L630+4

Davide Bonaventura

+2

·

Published

2023-08-21

·

Updated

2024-05-07

·

CVE-2023-38908

CVSS v3.1

6.5

Medium

VectorAV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions TP-Link Smart Bulb Tapo series L530 versions prior to 1.2.4 TP-Link Smart Bulb Tapo series L510E versions prior to 1.1.0 TP-Link Smart Bulb Tapo series L630 versions prior to 1.0.4 TP-Link Smart Bulb Tapo series P100 versions prior to 1.5.0 Tapo Application versions prior to 2.8.14
Description The issue allows a remote attacker to obtain sensitive information via the TSKEP authentication function. This is related to a lack of protection for service data in the TP-Link Tapo L530 Wi-Fi bulb's firmware.
Recommendations For TP-Link Smart Bulb Tapo series L530 versions prior to 1.2.4, update to version 1.2.4 or later. For TP-Link Smart Bulb Tapo series L510E versions prior to 1.1.0, update to version 1.1.0 or later. For TP-Link Smart Bulb Tapo series L630 versions prior to 1.0.4, update to version 1.0.4 or later. For TP-Link Smart Bulb Tapo series P100 versions prior to 1.5.0, update to version 1.5.0 or later. For Tapo Application versions prior to 2.8.14, update to version 2.8.14 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-04950
CVE-2023-38908

Affected Products

Tplink Smart Bulb Tapo Series L510E
Tplink Smart Bulb Tapo Series L530
Tplink Smart Bulb Tapo Series L630
Tplink Smart Bulb Tapo Series P100
Tapo Application