CVE-2023-38909

6.5 mediumEPSS 0.8%

Medium (6.5) in tp-link. EPSS 0.8% chance of exploitation in the next 30 days.

An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via the IV component in the AES128-CBC function.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
Published: 2023-08-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tp-link:tapo
tp-link:tapo_l530e_firmware

References

https://arxiv.org/abs/2308.09019
https://arxiv.org/pdf/2308.09019.pdf
https://www.dmi.unict.it/giamp/smartbulbscanbehackedtohackintoyourhousehold/
https://www.scitepress.org/Papers/2023/120929/120929.pdf
https://www.scitepress.org/PublicationsDetail.aspx?ID=X/auBv7JrSo=&t=1

Check your stack JSON