CVE-2023-38907

7.5 highEPSS 1.0%

High (7.5) in tp-link. EPSS 1.0% chance of exploitation in the next 30 days.

An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to replay old messages encrypted with a still valid session key.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
Published: 2023-09-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tp-link:tapo
tp-link:tapo_l530e_firmware

References

https://arxiv.org/abs/2308.09019
https://www.dmi.unict.it/giamp/smartbulbscanbehackedtohackintoyourhousehold/
https://www.scitepress.org/Papers/2023/120929/120929.pdf
https://www.scitepress.org/PublicationsDetail.aspx?ID=X/auBv7JrSo=&t=1
https://arxiv.org/abs/2308.09019

Check your stack JSON