CVE-2023-38909: tp-link tapo
Vulnerability summary
CVE-2023-38909 is a medium (CVSS 6.5) vulnerability in tp-link tapo. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 55.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 22-08-2023PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via the IV component in the AES128-CBC function.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
0.80%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
0.00 pp
From 0.80% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (arxiv.org)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Tp-link2 products
- tapo2.8.14
- tapo_l530e_firmware1.0.0
1 vendor · 2 products
References
5 links- www.scitepress.org/PublicationsDetail.aspx?ID=X/auBv7JrSo=&t=1Third Party Advisory
- arxiv.org/abs/2308.09019Third Party Advisory