Vulnerability Details : CVE-2023-38907
An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to replay old messages encrypted with a still valid session key.
Products affected by CVE-2023-38907
- cpe:2.3:a:tp-link:tapo:2.8.14:*:*:*:*:*:*:*
- cpe:2.3:o:tp-link:tapo_l530e_firmware:1.0.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-38907
0.15%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 51 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-38907
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST |
References for CVE-2023-38907
-
https://www.dmi.unict.it/giamp/smartbulbscanbehackedtohackintoyourhousehold/
Securing the IoT Ecosystem
-
https://www.scitepress.org/PublicationsDetail.aspx?ID=X/auBv7JrSo=&t=1
SciTePress - Publication DetailsThird Party Advisory
-
https://arxiv.org/abs/2308.09019
[2308.09019] Smart Bulbs can be Hacked to Hack into your HouseholdTechnical Description;Third Party Advisory
-
https://www.scitepress.org/Papers/2023/120929/120929.pdf
Jump to