Medium severity · published Aug 21, 2023
CVE-2023-38906
An issue in TPLink Smart Bulb Tapo series L530 1.1.9, L510E 1.0.8, L630 1.0.3, P100 1.4.9, Smart Camera Tapo series C200 1.1.18, and Tapo Application 2.8.14 allows a remote…
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
An issue in TPLink Smart Bulb Tapo series L530 1.1.9, L510E 1.0.8, L630 1.0.3, P100 1.4.9, Smart Camera Tapo series C200 1.1.18, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via the authentication code for the UDP message.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
Tapo · Tp-link
2.8.14 · source: NVD
TL
Tapo L530e Firmware · Tp-link
1.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-38906
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-38906
Third Party Advisory
https://arxiv.org/abs/2308.09019
www.dmi.unict.it
https://www.dmi.unict.it/giamp/smartbulbscanbehackedtohackintoyourhousehold/
www.scitepress.org
https://www.scitepress.org/Papers/2023/120929/120929.pdf
Third Party Advisory
https://www.scitepress.org/PublicationsDetail.aspx?ID=X/auBv7JrSo=&t=1
More from Tapo
8.1
CVE-2025-9293
Insufficient Certificate Validation in Multiple Mobile Applications Allows Man in the Middle Interception
7.5
CVE-2025-9292
Permissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud Controllers
7.5
CVE-2023-27098
TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel
7.5
CVE-2023-38907
An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to…
6.5
CVE-2023-34829
Incorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext